CVE-2023-7330

CVE-2023-7330 affects Ruijie NBR series routers. An unauthenticated arbitrary file upload vulnerability exists via /ddi/server/fileupload.php where attacker-controlled values in the name and uploadDir parameters are accepted and the multipart file content is saved without proper validation or san...

CVE-2022-4982

DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers frame.html and frame.A100.html that accept a path parameter content or sidebar which is not properly validated or canonicalized. An attacker c...

CVE-2022-4984

CVE-2022-4984 affects ZenTao Biz < 6.5, ZenTao Max < 3.0, and ZenTao Open Source Edition

CVE-2022-4982 DBLTek GoIP-1 vGHSFVT-1.1-67-5 Unauthenticated LFI

DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers frame.html and frame.A100.html that accept a path parameter content or sidebar which is not properly validated or canonicalized. An attacker c...

EUVD-2018-21611

PacsOne Server version 6.6.2 prior versions are likely affected contains a directory traversal vulnerability within the web-based DICOM viewer component. Successful exploitation allows a remote unauthenticated attacker to read arbitrary files via the 'nocache.php' endpoint with a crafted 'path'...

CVE-2021-4462

Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side...

PT-2025-46220

PacsOne Server version 6.6.2 prior versions are likely affected contains a directory traversal vulnerability within the web-based DICOM viewer component. Successful exploitation allows a remote unauthenticated attacker to read arbitrary files via the 'nocache.php' endpoint with a crafted 'path'...

VulnCheck KEV: CVE-2021-4462

Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side...

EUVD-2020-30818

Various Ruijie Gateway EG and NBR models firmware versions 11.16B9P1 11.94B12P1 contain a code execution vulnerability in the EWEB management system that can be abused via front-end functionality. Attackers can exploit front-end code when features such as guest authentication, local server...

CVE-2020-36870

Various Ruijie Gateway EG and NBR models firmware versions 11.16B9P1 11.94B12P1 contain a code execution vulnerability in the EWEB management system that can be abused via front-end functionality. Attackers can exploit front-end code when features such as guest authentication, local server...

CVE-2020-36870

CVE-2020-36870 affects Ruijie Gateway EG and Ruijie NBR series (firmware versions 11.1(6)B9P1 through 11.9(4)B12P1 are vulnerable). Root cause is a code execution vulnerability in the EWEB management system that can be abused via front-end functionality; when features such as guest authentication...

EUVD-2025-26142

Malicious code in bioql PyPI...

CVE-2025-7414

creationtimestamp| type| source ---|---|--- 2025-09-24 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-09-24 2025-10-01 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-10-01 2025-10-02 00:00:00+00:00| seen| The Shadowserver...

CVE-2023-7308

SecGate3600, a network firewall product developed by NSFOCUS, contains a sensitive information disclosure vulnerability in the /cgi-bin/authUser/authManageSet.cgi endpoint. The affected component fails to enforce authentication checks on POST requests to retrieve user data. An unauthenticated...

CVE-2024-13980

H3C Intelligent Management Center IMC versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters,...

CVE-2025-34163

Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access control. An attacker can upload arbitrary files, including executable scripts such as .ashx, via a crafted multipart/form-data POST reques...

CVE-2019-12593

creationtimestamp| type| source ---|---|--- 2025-08-20 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-08-20 2025-08-20 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-08-20 2026-06-08 00:00:00+00:00| exploited| The Shadowserver...

CVE-2023-34105

creationtimestamp| type| source ---|---|--- 2025-08-17 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-08-17 2025-08-19 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lwrsq2jwkz2c 2025-10-16 00:00:00+00:00| seen| The Shadowserver...

CVE-2018-13307

creationtimestamp| type| source ---|---|--- 2025-08-12 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-08-12 2025-08-25 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-08-25 2025-12-05 00:00:00+00:00| seen| The Shadowserver...

CVE-2020-35580

creationtimestamp| type| source ---|---|--- 2025-07-14 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2025-07-14 2026-06-07 00:00:00+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2026-06-07 2026-06-19 12:46:00+00:00| exploited|...