LinkJoin 安全漏洞

LinkJoin is a virtual course and meeting software by the individual developer Seth Raphael. A security vulnerability exists in LinkJoin version 882f196 that stems from improper handling of token ownership in the password reset feature...

LinkJoin 安全漏洞

LinkJoin is a virtual course and meeting software from the individual developer Seth Raphael. A security vulnerability exists in LinkJoin version 882f196, which stems from a lack of type checking in the password reset function...

CVE-2025-55138

CVE-2025-55138 concerns LinkJoin versions through 882f196, where the password-reset flow mishandles token ownership. This is a network-accessible issue with high impact on confidentiality and integrity (CVSS 7.4, HIGH). Connected sources identify the root cause as improper token ownership handlin...

PT-2025-32272 · Linkjoin · Linkjoin

Name of the Vulnerable Software and Affected Versions: LinkJoin versions through 882f196 Description: LinkJoin mishandles token ownership in the password reset functionality. Recommendations: Update LinkJoin to a version beyond 882f196...

CVE-2025-55138

LinkJoin through 882f196 mishandles token ownership in password reset...

CVE-2025-55137

LinkJoin through 882f196 mishandles lacks type checking in password reset...

CVE-2025-55138

LinkJoin through 882f196 mishandles token ownership in password reset...

WordPress Sala Theme 1.1.4 Privilege Escalation

WordPress Sala Theme versions 1.1.4 and below are vulnerable to an unauthenticated privilege escalation vulnerability. This flaw allows unauthenticated attackers to reset passwords of arbitrary users — including administrators — by directly invoking an exposed AJAX endpoint without verifying the...

CVE-2024-34327

Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form...

CVE-2024-34327

Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form...

CVE-2024-34327

Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form...

CVE-2014-125122 Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset

A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TMBlockURL parameter to the endpoint. By exploiting this flaw, an...

CVE-2014-125122

CVE-2014-125122 affects Linksys WRT120N: a stack-based buffer overflow in the tmUnblock.cgi endpoint, triggered by a specially crafted POST with an overly long TM_Block_URL, allows an unauthenticated attacker to overwrite memory and temporarily reset the admin password to blank, gaining access to...

CVE-2014-125122 Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset

A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TMBlockURL parameter to the endpoint. By exploiting this flaw, an...

CVE-2025-7689

The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhbresetpasswordcallback function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password o...

Sielox AnyWare 安全漏洞

Sielox AnyWare is an access control system from Sielox USA. A security vulnerability exists in Sielox AnyWare version v2.1.2, which stems from an unvalidated email address field in the password reset form, which could lead to SQL injection...

CVE-2024-34327

Sielox AnyWare v2.1.2 is affected by CVE-2024-34327, a SQL injection through the email field in the password-reset form. The connected exploit document provides a time-based blind PoC targeting the POST endpoint /auth/password-reset-token.php, using the email parameter and a SLEEP() payload to de...

PT-2025-31557 · Sielox · Sielox Anyware

Name of the Vulnerable Software and Affected Versions: Sielox AnyWare version 2.1.2 Description: The software contains a SQL injection issue via the email address field of the password reset form. Recommendations: Apply input validation and sanitization to the email address field in the password...

CVE-2024-34327

Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form...

(Pwn2Own) QNAP QHora-322 local_pwd_reset HTTP Request Smuggling Vulnerability

This vulnerability allows network-adjacent attackers to smuggle arbitrary HTTP requests on affected installations of QNAP QHora-322 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...