74967 matches found
HCL AION Information Disclosure Vulnerability (CNVD-2026-16403)
HCL AION is an AI lifecycle management platform from HCL India. HCL AION suffers from an information disclosure vulnerability that stems from the password field not disabling autocomplete, which can be exploited by an attacker to cause sensitive credentials to be stored or disclosed...
PT-2026-7672
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the use...
AVideo 授权问题漏洞
AVideo is an open-source broadcast network creation tool developed by the World Wide Broadcast Network. Version 8.1 of AVideo contains an authorization vulnerability, which stems from cross-site request forgery attacks. This vulnerability could allow attackers to exploit the password recovery...
Nsasoft GTalk Password Finder 安全漏洞
Nsasoft GTalk Password Finder is a password recovery tool developed by the US company Nsasoft. The version 2.2.1 of Nsasoft GTalk Password Finder contains a security vulnerability. This vulnerability stems from a buffer overflow in the Key field, which could lead to a denial-of-service attack...
PT-2026-7688
Top Password Firefox Password Recovery 2.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing input fields. Attackers can trigger the vulnerability by inserting 5000 characters into the User Name or Registration Code input fields...
PT-2026-7606
Name of the Vulnerable Software and Affected Versions thesystem version 1.0 Description thesystem version 1.0 has a persistent cross-site scripting issue. Attackers can inject malicious scripts through several server data input fields. Specifically, crafted script payloads can be submitted in the...
Microcom ZeusWeb 安全漏洞
Microcom ZeusWeb is a remote monitoring platform developed by the Spanish company Microcom. Version 6.1.31 of Microcom ZeusWeb contains a security vulnerability. This vulnerability stems from the injection of XSS payloads into the Email parameter in the “Recover password” section, which may lead ...
PT-2026-7620
Name of the Vulnerable Software and Affected Versions Affected versions not specified Description An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication. The vulnerable API endpoint is exposed without requiring any form of...
PT-2026-7690
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system...
Top Password MSN Password Recovery 安全漏洞
Top Password MSN Password Recovery is a MSN password recovery tool developed by Top Password Corporation. Version 1.30 of Top Password MSN Password Recovery contains a security vulnerability; this vulnerability stems from a buffer overflow in the registration code field, which may cause the...
PT-2026-7660
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials...
PT-2026-7671
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials...
Nsasoft SpotOutlook 安全漏洞
Nsasoft SpotOutlook is a tool developed by the US company Nsasoft, designed for retrieving and restoring the passwords of Microsoft Outlook email accounts. Version 1.2.6 of Nsasoft SpotOutlook contains a security vulnerability; this vulnerability stems from a buffer overflow in the Name input...
Top Password Dialup Password Recovery 安全漏洞
Top Password Dialup Password Recovery is a password recovery tool developed by Top Password Inc. Version 1.30 of Top Password Dialup Password Recovery has a security vulnerability; this vulnerability stems from a buffer overflow in the input fields, which could lead to a denial-of-service attack...
PT-2026-7691
ZIP Password Recovery 2.30 contains a denial of service vulnerability that allows attackers to crash the application by providing maliciously crafted input. Attackers can create a specially prepared text file with specific characters to trigger an application crash when selecting a ZIP file...
📄 libuser Denial of Service / Privilege Escalation
This is an old proof of concept from 2015 that demonstrates userhelper chfn newline filtering and libuser passwd file handling vulnerabilities. / roothelper.c - an unusual local root exploit against: CVE-2015-3245 userhelper chfn newline filtering CVE-2015-3246 libuser passwd file handling...
The vulnerability of the KLogic SCADA system’s virtual controller “KASCAD” allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the KLogic SCADA system “KASKAD”’s virtual controller is related to the use of a password hash instead of the actual password for authentication. Exploiting this vulnerability allows an intruder to compromise the confidentiality, integrity, and accessibility of the protected...
PT-2026-7689
Top Password Software Dialup Password Recovery 1.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing input fields. Attackers can trigger the vulnerability by inserting a large 5000-character payload into the User Name and Registration Code...
PT-2026-7512
Name of the Vulnerable Software and Affected Versions Videospirecore Theme Plugin versions prior to 1.0.7 Description The 'Videospirecore Theme Plugin' for WordPress is susceptible to privilege escalation, potentially leading to account takeover. The issue arises from insufficient validation of a...
CVE-2025-65128
A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers on the local network to modify router and network configurations. By invoking operations whose names end with "nocommit" and supplying the...