D-Link DIR-859 安全漏洞

The D-Link DIR-859 is a wireless router from China AUO D-Link. A security vulnerability exists in the D-Link DIR-859 v1.05 and earlier versions. An attacker can exploit this vulnerability to obtain a username and password by spoofing a post request to the /getcfg.php page...

CVE-2025-1360

A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msgto leads to cross site scripting. It is...

CVE-2025-1360 Internet Web Solutions Sublime CRM HTTP POST Request inicio.php cross site scripting

A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msgto leads to cross site scripting. It is...

CVE-2025-1360 Internet Web Solutions Sublime CRM HTTP POST Request inicio.php cross site scripting

A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msgto leads to cross site scripting. It is...

CVE-2025-1360

Summary: CVE-2025-1360 affects Internet Web Solutions Sublime CRM up to version 20250207. The vulnerability exists in the HTTP POST Request Handler, specifically an unknown function in the file /crm/inicio.php, where manipulation of the msg_to parameter leads to cross-site scripting. It can be ex...

CVE-2025-1270

Insecure direct object reference IDOR vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/hadatoshermano.php” endpoint to refer to another user. In addition, the...

CVE-2025-25357

A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the email POST request parameter...

CVE-2025-25387

A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the propertytype POST request parameter...

The vulnerability in the apc_client_pin.cgi script of D-Link DIR-825 router software allows a hacker to execute arbitrary commands.

The vulnerability in the apcclientpin.cgi script of D-Link DIR-825 router microprogramming software exists due to the failure to implement measures to neutralize special elements used in the operating system’s command for processing the wpspin parameter. Exploiting this vulnerability allows a...

CVE-2025-26156

A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter...

CVE-2023-2573

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be triggered by authenticated users via a crafted POST request...

CVE-2025-25357

A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the email POST request parameter...

CVE-2025-25356

A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the " todate" POST request parameter...

CVE-2025-1270 Insecure direct object reference (IDOR) vulnerability in H6Web

Insecure direct object reference IDOR vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/hadatoshermano.php” endpoint to refer to another user. In addition, the...

The vulnerability in the form2Wan.cgi script of the D-Link DIR-816A router’s software allows a hacker to execute arbitrary code.

The vulnerability of the form2Wan.cgi script in the D-Link DIR-816A2 router software is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTTP POST request...

The vulnerability in the form2WlanBasicSetup.cgi script of the D-Link DIR-816A router’s software allows a hacker to execute arbitrary code.

The vulnerability of the form2WlanBasicSetup.cgi microprogramming system of the D-Link DIR-816A2 router is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTTP POST request...

The vulnerability in the form2alg.cgi script of the D-Link DIR-816A router’s software allows a hacker to execute arbitrary code.

The vulnerability of the form2alg.cgi script in the microprogramming software of the D-Link DIR-816A2 router is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTTP POST request...

The vulnerability in the form2RepeaterSetup.cgi script of the D-Link DIR-816A router’s software allows a hacker to execute arbitrary code.

The vulnerability of the form2RepeaterSetup.cgi script in the D-Link DIR-816A2 router microprogramming software is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTTP POST request...

CVE-2025-25355

A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the fromdate POST request parameter...

CVE-2025-25356

A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the " todate" POST request parameter...