1685 matches found
EUVD-2025-197985
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials...
CVE-2025-41733
The CVE-2025-41733 issue affects METZ CONNECT EWIO2-M, EWIO2-M-BM, and EWIO2-BM devices. The commissioning wizard does not validate whether the device is already initialized, enabling an unauthenticated remote attacker to construct HTTP POST requests to set root credentials, potentially gaining f...
CVE-2025-41733 Possible malfunction credential injection
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials...
CVE-2025-41733: Authentication Bypass by Primary Weakness
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials...
The vulnerability of the formDeleteMeshNode() function in the wireless access point software of Tenda W30E allows a intruder to trigger a service failure.
The vulnerability of the formDeleteMeshNode function in the wireless access point software Tenda W30E is related to buffer overflows based on a stack mechanism when processing the String parameter. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending...
CVE-2025-10870: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests with the 'ultralogin' parameter in '/centrosnet/ultralogin.php'...
The vulnerability of the ipMacBindListStore() function in the Tenda G3 wireless access point’s microprogramming software allows a hacker to cause a service failure.
The vulnerability of the ipMacBindListStore function in the Tenda G3 wireless access point’s microprogramming software is related to buffer overflow when processing the listStr parameter. Exploiting this vulnerability allows an attacker to cause a service failure by sending specially crafted POST...
The vulnerability of the UploadCfg() function in the wireless access point software of Tenda W30E allows a intruder to cause a service failure.
The vulnerability of the UploadCfg function in the Tenda W30E wireless access point’s microprogramming software is related to buffer overflows during the processing of parameter v17. Exploiting this vulnerability can allow an attacker to cause service interruptions by sending specially crafted PO...
@react-native-community/cli has arbitrary OS command injection
The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...
CVE-2025-11953 Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary...
Cross-site Request Forgery (CSRF)
Overview org.jenkins-ci.plugins:themis is an A Jenkins plugin to communicate with a Themis instance. It can send report files to be analyzed by Themis and send a refresh request for a project. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to a lack of...
DELMIA Apriso Deserialization of Untrusted Data Vulnerability (CVE-2025-5086)
The version of DELMIA Apriso installed on the remote host is Release 2020 through 2025. It is, therefore, affected by a deserialization of untrusted data vulnerability CVE-2025-5086 that could allow an unauthenticated attacker to execute arbitrary code remotely. Exploitation involves sending a...
Exploit for Code Injection in Vmware Spring_Framework
Python Firewall for Spring4Shell CVE-2022-22965 Mitigation...
The vulnerability of the /upgrade_filter.asp file in the D-Link DI-7001 router’s microprogramming software allows a hacker to execute arbitrary code.
The vulnerability of the /upgradefilter.asp file in D-Link DI-7001 router microprogramming software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted POST requests...
The vulnerability of the formDelPortMapping() function in the Tenda G3 wireless access point software allows a intruder to trigger a service failure.
The vulnerability of the formDelPortMapping function in the Tenda G3 wireless access point software is related to buffer overflows due to the processing of the portMappingIndex parameter. Exploiting this vulnerability allows an attacker to cause service interruptions by sending specially crafted...
AndSoft e-TMS Operating System Command Injection Vulnerability
AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from an operating system command injection vulnerability, which is due to program misuse of parameter m in file /CLT/LOGINERRORFRM.ASP, and can be exploited by an attacker to execute operating system comman...
The vulnerability of D-Link DI-7001 router microprogramming software lies in the copying of buffers without checking the size of the input data. This allows a hacker to execute arbitrary code.
The vulnerability of D-Link DI-7001 router microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending specially crafted POST requests...
CVE-2025-40649 Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC
Stored Cross-Site Scripting XSS in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure BBMRI-ERIC, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using parameter text in '/api/v3/negotiations//posts'...