CVE-2025-60854

A vulnerability has been found in D-Link R15 AX1500 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd...

WordPress StreamTube Core plugin arbitrary user password change vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An arbitrary user password change vulnerability exists in the WordPress StreamTube Core plugin that originates from providing user-controlled access to objects, allowing a user ...

EUVD-2025-200290

A vulnerability has been found in D-Link R15 AX1500 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd...

CVE-2025-60854

A vulnerability has been found in D-Link R15 AX1500 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd...

CVE-2025-58386

In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new...

CVE-2025-60854

A vulnerability has been found in D-Link R15 AX1500 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd...

EUVD-2025-200246

User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetLastDatePasswordChange' in...

CVE-2025-41014

User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetLastDatePasswordChange' in...

CVE-2025-41014

CVE-2025-41014 affects TCMAN GIM v11 (version 20250304). Affected component: the web service at /WS/PDAWebService.asmx, using the parameter pda:username with soapaction GetLastDatePasswordChange. Root cause is user enumeration via an unauthenticated request, enabling determination of whether a us...

WordPress StreamTube Core plugin <= 4.78 - Unauthenticated Arbitrary User Password Change vulnerability

Unauthenticated Arbitrary User Password Change vulnerability discovered by Foxyyy in WordPress Plugin StreamTube Core versions = 4.78...

GHSA-CJCP-QXVG-4RJM Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

Summary A privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an existing administrator account, set a new...

CVE-2025-60854

A vulnerability has been found in D-Link R15 AX1500 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd...

D-Link R15 安全漏洞

D-Link R15 is a wireless router from China AUO D-Link. A security vulnerability exists in the D-Link R15 that originates from the incorrect operation of the model name parameter during a password change request in the web administrator page, which could lead to command injection...

PT-2025-48741

Name of the Vulnerable Software and Affected Versions D-Link R15 AX1500 versions prior to 1.20.02 Description A flaw exists in D-Link R15 AX1500 that allows for command injection. The issue occurs due to manipulation of the model name parameter during a password change request on the web...

CVE-2025-58386

In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new...

CVE-2025-60854

A vulnerability has been found in D-Link R15 AX1500 1.20.01 and below. By manipulating the model name parameter during a password change request in the web administrator page, it is possible to trigger a command injection in httpd...

PT-2025-48683

User Enumeration Vulnerability in TCMAN GIM v11 version 20250304. This vulnerability allows an unauthenticated attacker to determine whether a user exists on the system. The vulnerability is exploitable through the 'pda:username' parameter with 'soapaction GetLastDatePasswordChange' in...

CVE-2025-60854

CVE-2025-60854 affects D-Link R15 (AX1500) prior to 1.20.02. The vulnerability allows command injection in httpd by manipulating the model name parameter during a password change on the web administrator page. The CVSS v3.1 base score is 9.8 (CRITICAL) with network attack vector, no user interact...

CVE-2025-58386

Terminalfour 8–8.4.1.1 contains a server-side authorization flaw in the userLevel parameter of the user management function. A Power User can intercept and modify this parameter to elevate existing accounts to Administrator or invite new accounts with escalated privileges, and can also change the...

CVE-2025-66289

OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indefinitely. As a result, a disabled user, o...