CVE-2013-5754

The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it easier for remote attackers to obtain administrative access and change the administrator password via requests involving 1 ActiveX, 2 a...

CVE-2007-5714

The Gentoo ebuild of MLDonkey before 2.9.0-r3 has a p2p user account with an empty default password and valid login shell, which might allow remote attackers to obtain login access and execute arbitrary code...

CVE-2006-6999

attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified id parameter...

CVE-2003-0803

Nokia Electronic Documentation NED 5.0 allows remote attackers to use NED as an open HTTP proxy via a URL in the location parameter, which NED accesses and returns to the user...

CVE-2002-2201

The Printer Administration module for Webmin 0.990 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the printer name...

CVE-2009-3710

RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username dbadmin and password sq!us3r for an SSH tunnel, which allows remote attackers to gain privileges via port 8022...

CVE-2009-0809

The Web Editor in Dassault Systemes ENOVIA SmarTeam V5 before Release 18 Service Pack 8, and possibly CATIA and other products, allows remote authenticated users to read the profile card of an object in the document class via a link that is sent from the owner of the document object...

CVE-2000-1242

The HTTP service in American Power Conversion APC PowerChute uses a default username and password, which allows remote attackers to gain system access...

CVE-2001-1538

SpeedXess HA-120 DSL router has a default administrative password of "speedxess", which allows remote attackers to gain access...

CVE-2025-26086

An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get request handler. Attackers can remotely inject time-delayed SQL payloads to induce server response delays, enabling time-based inference and iterative extraction ...

CVE-2025-4869

A vulnerability classified as critical has been found in itsourcecode Restaurant Management System 1.0. This affects an unknown part of the file /admin/memberupdate.php. The manipulation of the argument menu leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-30475

Dell PowerScale InsightIQ vulnerable: versions 5.0–5.2 suffer improper privilege management that allows an unauthenticated, remote attacker to achieve elevated privileges. The issue, described across multiple sources (Dell advisory DSA-2025-186 and RH/CNVD-type entries), is a privilege-escalation...

PT-2025-21355 · Dell · Dell Powerscale Insightiq

Name of the Vulnerable Software and Affected Versions: Dell PowerScale InsightIQ version 5.2 Description: The issue is related to an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote access could potentially exploit this, leading to denial of service...

CVE-2024-12442

EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote shell access...

CVE-2025-47244

Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C reflection layer, as demonstrated by causing a denial of service when an attacker executes a loop calling RestartWeb or obtaining potentially sensitive information. Exploitation can occur if...

PT-2025-18691 · Kunbus +1 · Kunbus Revolution Pi Os +1

Name of the Vulnerable Software and Affected Versions: KUNBUS Revolution Pi OS Bookworm 01/2025 Description: The issue arises because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server, where the...

PT-2025-18702 · Tenda · Tenda Rx2 Pro

Name of the Vulnerable Software and Affected Versions: Tenda RX2 Pro version 16.03.30.14 Description: The issue is related to a lack of input validation/sanitization in the 'ate' management service, allowing an unauthorized remote attacker to gain root shell access to the device by sending a...

CVE-2025-46628

The CVE concerns Tenda RX2 Pro with a vulnerability in the ate management service. Lack of input validation/sanitization in the ate service allows an unauthorized remote attacker to gain root shell access by sending a crafted UDP packet while the service is enabled, with no authentication require...

PT-2025-19346 · Totolink · Totolink A720R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A720R version 4.1.5cu.374 Description: A critical issue affects the Log Handler component of TOTOLINK A720R, specifically the file /cgi-bin/cstecgi.cgi. The manipulation of the topicurl argument with the input...

CVE-2025-3665

A vulnerability has been found in TOTOLINK A3700R 9.1.2u.5822B20200513 and classified as critical. Affected by this vulnerability is the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit h...