CVE-2025-59111

Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which is not possible with GUI. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4...

CVE-2025-59117 Multiple Stored XSS in Windu CMS

Windu CMS is vulnerable to multiple Stored Cross-Site Scripting XSS vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulnerability can be exploited by a privileged user and may target users with higher privileges. Only version 4.1 was tested and confirmed as...

CVE-2025-59117

Windu CMS is affected by multiple Stored XSS vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. The flaws can be exploited by a privileged user and may affect users with higher privileges. This CVE entry pertains to Windu CMS 4.1, with tests confirming vulnerability in ...

EUVD-2025-197995

Windu CMS is vulnerable to multiple Stored Cross-Site Scripting XSS vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulnerability can be exploited by a privileged user and may target users with higher privileges. The vendor was notified early about this...

CVE-2025-59117 Multiple Stored XSS in Windu CMS

Windu CMS is vulnerable to multiple Stored Cross-Site Scripting XSS vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulnerability can be exploited by a privileged user and may target users with higher privileges. Only version 4.1 was tested and confirmed as...

EUVD-2025-197983

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution...

CVE-2025-41735

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution...

CVE-2025-41736

The CVE-2025-41736 vulnerability affects METZ CONNECT EWIO2 family (EWIO2-M, EWIO2-M-BM, EWIO2-BM) and is triggered by a path traversal in PHP that allows a low-privileged, remote attacker to upload or overwrite a Python script, resulting in remote code execution. Multiple sources describe the is...

CVE-2025-41735

CVE-2025-41735 affects METZ CONNECT EWIO2-M, EWIO2-M-BM, and EWIO2-BM devices. A low-privilege, unauthenticated remote attacker can upload arbitrary files to arbitrary locations due to missing file checks, potentially enabling remote code execution. The incident is corroborated by multiple source...

CVE-2025-41735 Possible arbitrary file upload

A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution...

Windu CMS 安全漏洞

Windu CMS Windu CMS is a lightweight web content management system CMS. A security vulnerability exists in Windu CMS version 4.1, which stems from improper access control and could result in a privileged user deleting the Super Administrator...

PT-2025-47292

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A low privileged remote attacker can upload any file to an arbitrary location due to a missing file check, potentially leading to remote code execution. The issue allows for unrestricted file uploads...

phpMyFAQ < 4.0.14 SQLi Vulnerability (GHSA-fxm2-cmwj-qvx4)

phpMyFAQ is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"; if...

HPE Aruba Networking Management Software 安全漏洞

HPE Aruba Networking Management Software is a network management platform from HPE America. A security vulnerability exists in HPE Aruba Networking Management Software Airwave that stems from a command injection vulnerability in the command line interface that could lead to the execution of...

PT-2025-47325

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.4.0p16 Description A flaw exists in Checkmk where inadequate permission checks allow users with limited privileges to alter notification settings through the REST API. This could potentially result in unauthorized...

CVE-2025-31649

A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call...

EUVD-2025-197900

A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call...

CVE-2025-31649 Dell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerability

A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call...

CVE-2025-31649

CVE-2025-31649: Dell ControlVault WBDI Driver hard-coded password vulnerability in ControlVault3 prior to 5.15.14.19 and ControlVault3 Plus prior to 6.2.36.47. A specially crafted API call can lead to execution of privileged operations. TALOS confirms vulnerable versions (e.g., 5.14.3.0) and the ...

CVE-2025-31649 Dell ControlVault3 ControlVault WBDI Driver hard-coded password vulnerability

A hard-coded password vulnerability exists in the ControlVault WBDI Driver functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted ControlVault API call can lead to execute priviledged operation. An attacker can issue an api call...