CVE-2025-26156

A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter...

CVE-2023-2573

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be triggered by authenticated users via a crafted POST request...

CVE-2025-25357

A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the email POST request parameter...

CVE-2025-25356

A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the " todate" POST request parameter...

CVE-2025-1270 Insecure direct object reference (IDOR) vulnerability in H6Web

Insecure direct object reference IDOR vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/hadatoshermano.php” endpoint to refer to another user. In addition, the...

CVE-2025-25356

CVE-2025-25356 affects PHPGurukul Land Record System v1.0. The vulnerability is a SQL injection in /admin/bwdates-reports-details.php, exploitable via the todate parameter in a POST request, potentially allowing remote code execution. Reported metrics indicate a HIGH severity (CVSS v3.1: 7.2) wit...

The vulnerability in the form2WlanBasicSetup.cgi script of the D-Link DIR-816A router’s software allows a hacker to execute arbitrary code.

The vulnerability of the form2WlanBasicSetup.cgi microprogramming system of the D-Link DIR-816A2 router is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTTP POST request...

The vulnerability in the form2alg.cgi script of the D-Link DIR-816A router’s software allows a hacker to execute arbitrary code.

The vulnerability of the form2alg.cgi script in the microprogramming software of the D-Link DIR-816A2 router is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTTP POST request...

The vulnerability in the form2Wan.cgi script of the D-Link DIR-816A router’s software allows a hacker to execute arbitrary code.

The vulnerability of the form2Wan.cgi script in the D-Link DIR-816A2 router software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTTP POST request...

The vulnerability in the form2RepeaterSetup.cgi script of the D-Link DIR-816A router’s software allows a hacker to execute arbitrary code.

The vulnerability of the form2RepeaterSetup.cgi script in the D-Link DIR-816A2 router microprogramming software is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTTP POST request...

CVE-2024-56908

Perfex CRM versions before 3.2.1 are affected by CVE-2024-56908. An authenticated attacker can issue a crafted HTTP POST to the upload_sales_file endpoint and supply malicious input in the rel_id parameter, taking advantage of improper input validation to bypass restrictions and upload arbitrary ...

CVE-2025-25356

A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the " todate" POST request parameter...

GatesAir Maxiva 安全漏洞

GatesAir Maxiva is a series of transmitters from GatesAir USA. A security vulnerability exists in the GatesAir Maxiva UAXT Transmitter and VAXT Transmitter that stems from improperly validated POST request processing when debug mode is enabled, resulting in remote code execution...

CVE-2024-56908

In Perfex Crm 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected uploadsalesfile endpoint. By providing malicious input in the relid parameter, combined with improper input validation, the attacker can bypass restrictions and upload arbitrary files to directorie...

CVE-2025-25355

A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the fromdate POST request parameter...

The vulnerability of the formSetSambaConf function in the Tenda AC18 router microprogramming system allows a attacker to execute arbitrary commands.

The vulnerability of the formSetSambaConf function in the Tenda AC18 router microprogramming system exists due to the lack of measures taken to neutralize special elements during the processing of the usbName parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

The vulnerability of the d_status.asp component of the D-Link DIR-816A router’s microprogramming system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the dstatus.asp component of the D-Link DIR-816A2 router’s microprogramming system is related to the disclosure of information. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially...

The vulnerability of the websURLFilterAddDel component of the D-Link DIR-816A router’s microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the websURLFilterAddDel component of the D-Link DIR-816A2 router’s microprogramming software is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code through a specially created HTTP POST request...

The vulnerability of the formSetClientState function in the Tenda AC18 router software allows a attacker to trigger a service failure or execute arbitrary code.

The vulnerability of the formSetClientState function in the Tenda AC18 router software is related to buffer overflows in the stack when processing the limitSpeedUp parameter. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code using a specially...

CVE-2025-25352

CVE-2025-25352 : A SQL injection vulnerability exists in PHPGurukul Land Record System v1.0, specifically in /admin/aboutus.php where the POST parameter pagetitle can be exploited to execute arbitrary SQL code. This affects the affected software/component as described in the linked sources; explo...