CVE-2026-71909 DrayTek VigorAP Multiple Models OS Command Injection via InquierTime

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands...

CVE-2026-71909 DrayTek VigorAP Multiple Models OS Command Injection via InquierTime

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands...

CVE-2026-71909

DrayTek VigorAP (multiple models) is affected by an OS command injection vulnerability in the InquierTime function, caused by insufficient filtering of the time field before it is passed to command execution. A remote attacker with valid administrative credentials to the device's web management i...

PT-2026-80943

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands...

CVE-2026-11881

The Fluent Forms WordPress plugin versions prior to 6.2.6 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape specific form field configuration settings before they are outputted within an inline script during form rendering. An attac...

CVE-2026-11881 Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

CVE-2026-11881 Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

Security update for grafana

This update for grafana fixes the following issues: grafana was updated from version 9.5.18 to 10.4.13 jscPED-11591,jscPED-11649: Security issues fixed: CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading golang.org/x/crypto bsc1234554 CVE-2023-3128: Fixed...

SUSE CVE-2024-7264

libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the time fraction, leading to a strlen getting performed on a pointer to a heap buffer area that i...

XSS in Schedule tab of Documents

Description pimcore is vulnerable to XSS at Time field in Schedule tab of Document. Payload " Proof of Concept 1.Go to https://demo.pimcore.fun/admin/ and login. 2.In Documents, go to home - click on Schedule icon to go to this tab. 3.In the Schedule tab, input the payload " into the Time field a...

SUSE CVE-2013-4168

Cross-site scripting XSS vulnerability in SmokePing 2.6.9 in the start and end time fields...

CVE-2021-30174

RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks...

UBUNTU-CVE-2013-4168

Cross-site scripting XSS vulnerability in SmokePing 2.6.9 in the start and end time fields...

CVE-2013-4168: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SmokePing 2.6.9 in the start and end time fields...

CVE-2018-17653

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Foxit Reader and Foxit PhantomPDF for Windows Memory Misreference Vulnerability (CNVD-2018-25203)

Foxit Reader for Windows is a Windows-based PDF document reader from China's Foxit Foxit Software Corporation.Foxit PhantomPDF for Windows is its commercial version. A memory misreference vulnerability exists in the processing of the getItemState method of TimeField in Foxit Reader 9.2.0.9297 and...

CVE-2018-15504

An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11...

UBUNTU-CVE-2015-1789

The X509cmptime function in crypto/x509/x509vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted length field in ASN1TIME data, as demonstrated...

i.FTP 2.21 - Time Field (SEH)

!/usr/bin/python Exploit Title : i.FTP 2.21 Time Field SEH Exploit Exploit Author : Revin Hadi S Vulnerability PoC : Avinash Kumar Thapa "-Acid" PoC Link : https://www.exploit-db.com/exploits/36847/ Date : 05/08/2015 Vendor : http://www.memecode.com/iftp.php Software Link :...

i.FTP 2.21 - Time Field SEH Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python Exploit Title : i.FTP 2.21 Time Field SEH Exploit Exploit Author : Revin Hadi S Vulnerability PoC : Avinash Kumar Thapa "-Acid" Date : 05/08/2015 Vendor : http://www.memecode.com/iftp.php Software Link :...