CVE-2025-46581 ZTE ZXCDN product has a Struts RCE Vulnerability

ZTE's ZXCDN product is affected by a Struts remote code execution RCE vulnerability. An unauthenticated attacker can remotely execute commands with non-root privileges...

CVE-2025-41707

The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality...

CVE-2025-41705

An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...

CVE-2025-41703

An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command...

CVE-2025-41706 Phoenix Contact: Webserver Denial of Service through Malformed Content-Length

The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...

CVE-2025-41705

CVE-2025-41705 is reported as an unauthenticated MITM issue where an attacker can intercept websocket messages to obtain login credentials from the Webfrontend. Connected sources identify Phoenix Contact QUINT4-UPS/24DC/24DC/10/EIP as the affected device family, with the vulnerability described a...

EUVD-2025-34146

An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...

CVE-2025-41705 Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials

An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...

EUVD-2025-34149

An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality...

PT-2025-41941

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.4.0 through 7.4.3 and prior to 7.2.7 FortiProxy versions 7.4.0 through 7.4.3 and prior to 7.2.9 FortiPAM versions prior to 1.2.0 FortiSwitchManager versions 7.2.0 through 7.2.3 and 7.0.0 through 7.0.3 Description An improper...

Siemens TeleControl Server Basic 访问控制错误漏洞

Siemens TeleControl Server Basic is an industrial remote controller from Siemens Germany. An access control error vulnerability exists in Siemens TeleControl Server Basic versions V3.1.2.2 through prior to V3.1.2.3, which originates from an unauthenticated, remote attacker being able to obtain a...

PT-2025-41854

Name of the Vulnerable Software and Affected Versions Modbus affected versions not specified Description An unauthenticated remote attacker can cause a denial of service DoS condition affecting the Modbus service. This is achieved by sending a specific function and sub-function code. The core...

CVE-2025-9713

Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required...

PT-2025-41797

Name of the Vulnerable Software and Affected Versions rAthena versions prior to commit af2f3ba Description rAthena is an open-source cross-platform MMORPG server. A use-after-free issue exists in the RODEX functionality of rAthena’s map-server. An unauthenticated attacker can exploit this issue v...

CVE-2025-11167

The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.5.6. This is due to insufficient validation on the redirect url supplied via the 'redirecturl' parameter. This make...

EUVD-2025-33848

The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the adminprocesswidgetpagechange function. This makes it possible for unauthenticated attackers to modify widget pa...

EUVD-2025-33822

The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.5.6. This is due to insufficient validation on the redirect url supplied via the 'redirecturl' parameter. This make...

PT-2025-41647

Name of the Vulnerable Software and Affected Versions CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress versions through 2.5.6 Description The software is susceptible to an Open Redirect issue because of inadequate validation of the redirec...

CVE-2025-35057

Newforma Info Exchange NIX '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the NIX service account...

CVE-2025-11198

A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. If a trusted user initiates deployment, Security Director Policy Enforcer wil...