CVE-2026-100298

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation...

CVE-2024-31027

Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...

CVE-2026-100298

Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4 is vulnerable to a flaw where two user-information endpoints can reveal sensitive device and account details . This occurs under conditions not intended for normal operation. While the impact is rated as High for confidentiality, integrity, and avai...

EUVD-2026-89407

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation...

CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

EUVD-2026-89405

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CrushFTP_CVE-2025-54309

CVE-2025-54309 - CrushFTP Affected Versions 10.8.5 11.3.434 Race condition PoC by watchtower, adjusted to be more extensible. python crushedftp.py usage: crushedftp.py -h -u USERNAME -p PASSWORD -r REQUESTS -P PAYLOAD target CrushFTP CVE-2025-54309 XML Race Condition Exploit positional arguments:...

CVE-2026-76728

A vulnerability exists in the API endpoint of HPE Networking Instant ON APs , where an authenticated remote attacker with high privileges can perform a server-side request forgery (SSRF) attack. Successful exploitation may enable the attacker to execute arbitrary commands as a privileged user on ...

CVE-2026-76728 Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...

CVE-2026-76727 Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

EUVD-2026-89346

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

CVE-2026-76724

A command injection vulnerability exists in the Command Line Interface (CLI) of HPE Networking Instant ON APs when accessed via the PAPI protocol . An unauthenticated adjacent attacker can exploit this by sending specially crafted packets to perform command injection. Successful exploitation allo...

CVE-2026-76724 Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a...

CVE-2026-76724 Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a...

EUVD-2026-89340

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the...

CVE-2026-76721 Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the...

CVE-2026-76721

A buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON APs . This flaw allows an unauthenticated remote attacker to execute arbitrary code on the underlying host. If successfully exploited, the attacker could gain the ability to run code as a privileged user...

CVE-2026-61797

CVE-2026-61797 — GLPI PDF Plugin Time-Based Blind SQL Injection Proof of Concept for CVE-2026-61797 , a time-based blind SQL Injection vulnerability affecting the GLPI PDF plugin. The vulnerability can be reached through: /marketplace/pdf/front/preference.form.php In the vulnerable implementation...

CVE-2017-5487

PoC - CVE-2017-5487 - WordPress User Enumeration via REST Setup git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 Usage .\Enumerate-WordPressOrgMembersREST.ps1 Alternate Route 1 for WAF Bypass...