PT-2025-40958

Name of the Vulnerable Software and Affected Versions Campcodes Online Apartment Visitor Management System version 1.0 Description A security issue exists in Campcodes Online Apartment Visitor Management System 1.0 related to the processing of the /index.php file. Manipulation of the Username...

OpenBSD OpenSSH < 10.1 Multiple Vulnerabilities

OpenBSD OpenSSH is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openbsd:openssh";...

CVE-2025-11348: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in Campcodes Online Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been...

EUVD-2025-32589

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. A configuration...

AZL-68231 CVE-2025-61984 affecting package openssh for versions less than 9.8p1-5

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. A configuration...

CVE-2025-61984

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. A configuration...

CVE-2025-61985

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used...

CVE-2025-58584

In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally...

CVE-2025-58586

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one...

CVE-2025-58583

The application provides access to a login protected H2 database for caching purposes. The username is prefilled...

CVE-2025-11325

A security flaw has been discovered in Tenda AC18 15.03.05.196318. Affected by this issue is some unknown functionality of the file /goform/fastsettingpppoeset. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack is possible to be carried out...

CVE-2025-11325

A security flaw has been discovered in Tenda AC18 15.03.05.196318. Affected by this issue is some unknown functionality of the file /goform/fastsettingpppoeset. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack is possible to be carried out...

CVE-2025-58579 Username Disclosure Through Missing Authentication

Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration...

CVE-2025-58579 Username Disclosure Through Missing Authentication

Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration...

CVE-2025-58586

CVE-2025-58586 affects SICK Enterprise Analytics and SICK Logistic Analytics products. The vulnerability stems from distinct error messages for login failures (incorrect password vs. non-existent username), enabling attacker-driven username enumeration. Reported impact: information disclosure (us...

EUVD-2025-32508

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one...

CVE-2025-58586

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one...

EUVD-2025-32509

A security flaw has been discovered in Tenda AC18 15.03.05.196318. Affected by this issue is some unknown functionality of the file /goform/fastsettingpppoeset. Performing manipulation of the argument Username results in stack-based buffer overflow. The attack is possible to be carried out...

CVE-2025-11325

CVE-2025-11325 affects Tenda AC18 routers (firmware around 15.03.05.19(6318)). The vulnerability is a stack-based overflow in the /goform/fast_setting_pppoe_set handler triggered by manipulating the Username parameter. It is remotely exploitable, with public exploit code available. Impact include...

CVE-2025-11325 Tenda AC18 fast_setting_pppoe_set stack-based overflow

A security flaw has been discovered in Tenda AC18 15.03.05.196318. Affected by this issue is some unknown functionality of the file /goform/fastsettingpppoeset. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack is possible to be carried out...