CVE-2025-58586

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one...

EUVD-2025-32509

A security flaw has been discovered in Tenda AC18 15.03.05.196318. Affected by this issue is some unknown functionality of the file /goform/fastsettingpppoeset. Performing manipulation of the argument Username results in stack-based buffer overflow. The attack is possible to be carried out...

CVE-2025-11325

CVE-2025-11325 affects Tenda AC18 routers (firmware around 15.03.05.19(6318)). The vulnerability is a stack-based overflow in the /goform/fast_setting_pppoe_set handler triggered by manipulating the Username parameter. It is remotely exploitable, with public exploit code available. Impact include...

CVE-2025-11325 Tenda AC18 fast_setting_pppoe_set stack-based overflow

A security flaw has been discovered in Tenda AC18 15.03.05.196318. Affected by this issue is some unknown functionality of the file /goform/fastsettingpppoeset. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack is possible to be carried out...

CVE-2025-11325 Tenda AC18 fast_setting_pppoe_set stack-based overflow

A security flaw has been discovered in Tenda AC18 15.03.05.196318. Affected by this issue is some unknown functionality of the file /goform/fastsettingpppoeset. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack is possible to be carried out...

CVE-2025-58584 Plain Text Transmission of Username and Password in the URL

In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally...

CVE-2025-58584 Plain Text Transmission of Username and Password in the URL

In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally...

CVE-2025-58584

CVE-2025-58584 pertains to credentials transmitted in the URL as parameters in HTTP requests, which can be logged or cached by servers, browsers, or proxies. Connected docs associate this with SICK Enterprise Analytics and SICK Logistic Analytics products and indicate a risk of disclosure of user...

CVE-2025-58583 User Enumeration

The application provides access to a login protected H2 database for caching purposes. The username is prefilled...

CVE-2025-58583 User Enumeration

The application provides access to a login protected H2 database for caching purposes. The username is prefilled...

EUVD-2025-32496

The application provides access to a login protected H2 database for caching purposes. The username is prefilled...

CVE-2025-58583

CVE-2025-58583 affects SICK Enterprise Analytics and SICK Logistic Analytics products. The vulnerability stems from a login-protected H2 database used for caching where the username is prefilled, potentially enabling unauthorized access to the system. The available connected documents describe th...

CVE-2025-11323

A vulnerability was determined in UTT 1250GW up to v2v3.2.2-200710. Affected is the function strcpy of the file /goform/formUserStatusRemark. This manipulation of the argument Username causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed a...

CVE-2025-11323 UTT 1250GW formUserStatusRemark strcpy buffer overflow

A vulnerability was determined in UTT 1250GW up to v2v3.2.2-200710. Affected is the function strcpy of the file /goform/formUserStatusRemark. This manipulation of the argument Username causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed a...

PT-2025-40863

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The application provides access to a login-protected H2 database used for caching. The username is prefilled, potentially allowing unauthorized access if defaul...

CVE-2025-58586: Observable Response Discrepancy

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one...

CVE-2025-11325: Stack-based Buffer Overflow

A security flaw has been discovered in Tenda AC18 15.03.05.196318. Affected by this issue is some unknown functionality of the file /goform/fastsettingpppoeset. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack is possible to be carried out...

PT-2025-40852

Name of the Vulnerable Software and Affected Versions UTT versions prior to v2v3.2.2-200710 Description A buffer overflow issue exists in the strcpy function within the /goform/formUserStatusRemark file. Manipulation of the Username argument can trigger this issue, potentially allowing for remote...

SICK AG Baggage Analytics 安全漏洞

SICK AG Baggage Analytics is a visualization and analysis software for airport tracking systems from SICK AG, Germany. A security vulnerability exists in SICK AG Baggage Analytics that stems from a different error message being returned on login failure, which could lead to a username enumeration...

PT-2025-40857

Name of the Vulnerable Software and Affected Versions Tenda AC18 version 15.03.05.196318 Description A security issue exists in Tenda AC18 routers. A stack-based buffer overflow can occur due to manipulation of the Username argument within the /goform/fast setting pppoe set file. This issue is...