CVE-2025-57802 Airlink's Daemon Symlink Vulnerability

Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel. In version 1.0.0, an attacker with access to the affected container can create symbolic links inside the mounted directory /app/data. Because the container bind-mounts an...

CVE-2025-57802

Airlink’s Daemon vulnerability (CVE-2025-57802) affects version 1.0.0, where an attacker with access to the affected container can create symbolic links inside the mounted /app/data directory. Because the container bind-mounts an arbitrary host path, these symlinks can point to sensitive host loc...

CVE-2025-55575

SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=servicedetail...

CVE-2025-29525

DASAN GPON ONU H660WM OS version H660WMR210825 Hardware version DS-E5-583-A1 was discovered to contain insecure default credentials in the modem's control panel...

Remote Code Execution (RCE)

github.com/tnborg/panel is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper path handling in the CleanPath middleware from the go-chi/chi package, which fails to process r.URL.Path, followed by flaws in backend login path exposure, which allows an attacker to bypass...

CVE-2025-29525

DASAN GPON ONU H660WM OS version H660WMR210825 Hardware version DS-E5-583-A1 was discovered to contain insecure default credentials in the modem's control panel...

CVE-2025-55575

SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=servicedetail...

CVE-2025-29525

DASAN GPON ONU H660WM OS version H660WMR210825 Hardware version DS-E5-583-A1 was discovered to contain insecure default credentials in the modem's control panel...

CVE-2025-55575

SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=servicedetail...

PT-2025-34673 · Smm Panel · Smm Panel

Name of the Vulnerable Software and Affected Versions: SMM Panel version 3.1 Description: A SQL Injection vulnerability exists in SMM Panel version 3.1. This allows remote attackers to potentially gain sensitive information by sending a crafted HTTP request with the action parameter set to servic...

PT-2025-34689 · Docker +1 · Docker +1

Name of the Vulnerable Software and Affected Versions: Airlink versions prior to 1.0.1 Description: Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel. An attacker with access to the affected container can create symbolic links...

SmmFollows SMM Panel 安全漏洞

SmmFollows SMM Panel is an online platform from SmmFollows, Inc. A security vulnerability exists in SmmFollows SMM Panel version 3.1, which stems from an SQL injection in the action=servicedetail parameter, which could lead to the disclosure of sensitive information...

CVE-2025-55575

Summary: CVE-2025-55575 is a SQL Injection vulnerability in SMM Panel 3.1 that allows remote attackers to disclose sensitive information via a crafted HTTP request with the parameter action=service_detail. The CVSS v3.1 base score is 9.8 (CRITICAL) with network access, low attack complexity, no p...

CVE-2025-50858

Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter...

CVE-2025-50859

Reflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the template parameter...

CVE-2025-50860

SQL Injection in the listdomains function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter...

CVE-2025-50858

Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter...

CVE-2025-50859

Reflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the template parameter...

CVE-2025-50858

Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter...

CVE-2025-50859

Reflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the template parameter...