CVE-2012-10062

CVE-2012-10062 affects XAMPP 1.7.3 with default WebDAV configuration, where the WebDAV service at /webdav/ accepts HTTP PUT using default credentials, allowing remote authenticated attackers to upload a PHP payload and trigger execution via a GET request, resulting in remote code execution on the...

CVE-2025-54946

A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands...

CVE-2025-54946 SUNNET Corporate Training Management System - SQL Injection

A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands...

CVE-2025-54946 SUNNET Corporate Training Management System - SQL Injection

A SQL injection vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary SQL commands...

CVE-2025-54945 SUNNET Corporate Training Management System - External Control of File Name or Path

An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to execute arbitrary system commands via a malicious file by controlling the destination file path...

ContentKeeper Web Appliance 安全漏洞

ContentKeeper Web Appliance is a web content filtering and security gateway appliance from ContentKeeper Australia. A security vulnerability exists in the ContentKeeper Web Appliance versions prior to 125.10 that stems from the mimencode CGI tool mishandling file uploads, which could lead to remo...

PT-2025-35341

Name of the Vulnerable Software and Affected Versions SUNNET Corporate Training Management System versions prior to 10.11 Description A SQL injection flaw exists in SUNNET Corporate Training Management System. This issue allows remote attackers to execute arbitrary SQL commands. Recommendations...

Linux Distros Unpatched Vulnerability : CVE-2020-24614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-in...

CVE-2025-9377 Authenticated RCE via Parental Control command injection

The authenticated remote command execution RCE vulnerability exists in the Parental Control page on TP-Link Archer C7EU V2 and TL-WR841N/NDMS V9. This issue affects Archer C7EU V2: before 241108 and TL-WR841N/NDMS V9: before 241108. Both products have reached the status of EOL end-of-life. It's...

CVE-2025-9659 O2OA Personal Profile widget cross site scripting

A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /xportalassembledesigner/jaxrs/widget of the component Personal Profile Page. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been...

PT-2025-35225

Name of the Vulnerable Software and Affected Versions: AiondaDotCom mcp-ssh versions through 1.0.3 Description: A security flaw exists in AiondaDotCom mcp-ssh related to an unknown functionality within the file server-simple.mjs component. Manipulation of this functionality can lead to remote...

CVE-2025-9586

CVE-2025-9586 affects Comfast CF-N1 firmware version 2.6.0. The vulnerability resides in the wireless_device_dissoc function of /usr/bin/webmgnt, where manipulating the mac argument leads to command injection. Exploitation appears feasible remotely, and public PoCs/exploits exist. Multiple connec...

CVE-2025-9579 LB-LINK BL-X26 HTTP set_hidessid_cfg os command injection

A weakness has been identified in LB-LINK BL-X26 1.2.8. The impacted element is an unknown function of the file /goform/sethidessidcfg of the component HTTP Handler. This manipulation of the argument enable causes os command injection. The attack can be initiated remotely. The exploit has been ma...

CVE-2025-9579

CVE-2025-9579 affects LB-LINK BL-X26 v1.2.8; the HTTP Handler’s /goform/set_hidessid_cfg component permits remote command execution via manipulation of the enable argument. The vulnerability stems from an argument handling issue, enabling an OS command injection. Public PoC/exploit code exists, a...

CVE-2025-34523 Arcserve UDP < 10.2 Pre-Authentication Heap Overflow

A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection UDP. This flaw is reachable without authentication and results from improper bounds checking when processing attacker-controlled input. By sending specially crafted...

Linux Distros Unpatched Vulnerability : CVE-2018-4089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Safari before 11.0.3 is affected. tvOS befor...

Linux Distros Unpatched Vulnerability : CVE-2024-7776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in the downloadmodel function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to...

Linux Distros Unpatched Vulnerability : CVE-2021-22205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a fil...

CVE-2025-22411

In processserviceattrrsp of sdpdiscovery.cc, there is a possible use after free due to a logic error in the code. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

Picklescan has a missing detection when calling built-in python lib2to3.pgen2.grammar.Grammar.loads

Summary Using lib2to3.pgen2.grammar.Grammar.loads, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to lib2to3.pgen2.grammar.Grammar.loads function in reduce meth...