CVE-2025-57389

CVE-2025-57389 - OpenWRT 18.06.2 中的反射型 XSS 描述 在已停止维护（EOL）的 Luci OpenWRT v18.06.2 的 /cgi-bin/luci/admin/system/packages 端点上发现了一个反射型跨站脚本（XSS）漏洞。 概念验证 1. 在将流量代理到 Burp 的同时，导航至 http://192.168.56.2/cgi-bin/luci/admin/system/packages， 2. 在 Filter （过滤器）中输入任意软件包名称并提交， 3. 将发送到该端点的 POST 请求转发到 Repeater， 4. 在...

PT-2025-47949

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official...

CVE-2025-6171 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker with reporter access to view branch names and pipeline details by accessing the packages API endpoint even wh...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab CE and EE versions 13.2 through 18.3...

PT-2025-47051

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.2 through 18.3.5 GitLab CE/EE versions 18.4 through 18.4.3 GitLab CE/EE versions 18.5 through 18.5.1 Description An authenticated attacker with reporter access could view branch names and pipeline details by accessing...

CVE-2025-57389

A reflected cross-site scripting XSS vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. This vulnerability was fixed in OpenWRT v19.07.0...

OpenWRT Luci LTS 安全漏洞

OpenWRT Luci LTS is an OpenWRT open source web management interface for Linux distributions. A security vulnerability exists in OpenWRT Luci LTS version v18.06.2, which originates from the presence of reflective cross-site scripting in the /admin/system/packages endpoint, which could lead to the...

PT-2024-24590

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 24.4.0 Description A SQL injection vulnerability in the POST /search/search=packages endpoint in LibreNMS allows a user with global read privileges to execute SQL commands via the package parameter. This vulnerabilit...

PT-2022-25196 · Unknown · Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: Online Tours & Travels Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/tour/admin/update packages.php" API endpoint...