CVE-2025-60682

A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614B20230630 within the cloudupdatecheck binary, specifically in the sub402414 function that handles cloud update parameters. User-supplied 'magicid' and 'url' values are directly concatenated into shell...

CVE-2025-60682: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614B20230630 within the cloudupdatecheck binary, specifically in the sub402414 function that handles cloud update parameters. User-supplied 'magicid' and 'url' values are directly concatenated into shell...

CVE-2025-60699

A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592B20191022ALL within the global.so binary. The getSaveConfig function retrieves the httphost parameter from user input via websGetVar and copies it into a fixed-size stack buffer v13 using strcpy without...

CVE-2025-60702: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592B20191022ALL within the system.so binary. The setDiagnosisCfg function retrieves the ipDoamin parameter from user input via websGetVar and concatenates it directly into a ping system command executed via...

CVE-2025-60700

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1FW102B02 within the prog.cgi and librcm.so binaries. The sub4455BC function in prog.cgi stores user-supplied SetDMZSettings/IPAddress values in NVRAM via nvramsafeset"dmzipaddr", .... These values are later...

CVE-2025-60700: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in the D-Link DIR-882 Router firmware DIR882A1FW102B02 within the prog.cgi and librcm.so binaries. The sub4455BC function in prog.cgi stores user-supplied SetDMZSettings/IPAddress values in NVRAM via nvramsafeset"dmzipaddr", .... These values are later...

PT-2025-46854

Name of the Vulnerable Software and Affected Versions Cisco Catalyst Center affected versions not specified Description A flaw exists in the web-based management interface of Cisco Catalyst Center that could permit a remote attacker, without needing to authenticate, to carry out a cross-site...

Siemens SIMATIC and SCALANCE Improper Input Validation (CVE-2025-3360)

Describe what is the vulnerability about, e.g.: Affected devices do not properly validate input in the hack-me endpoint of the web service. 2. Describe what an attacker could do with it - e.g.: This could allow an unauthenticated remote attacker to execute arbitrary code on the device. This...

CVE-2025-12870

The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges...

CVE-2016-15055: Improper Limitation of a Pathname to a Restricted Directory

JVC VN-T IP-camera models firmware versions up to 2016-08-22 confirmed on the VN-T216VPRU model contain a directory traversal vulnerability in the checkcgi endpoint that accepts a user-controlled file parameter. An unauthenticated remote attacker can leverage this vulnerability to read arbitrary...

编号撤回

ViewLead Bacteriology Laboratory Reporting System is a Bacteriology Laboratory Reporting System from China-based ViewLead. The ViewLead Bacteriology Laboratory Reporting System suffers from a SQL injection vulnerability that originates from SQL injection and could allow an unauthenticated, remote...

EUVD-2025-106748

A vulnerability has been identified in LOGO! 12/24RCE 6ED1052-1MD08-0BA2 All versions, LOGO! 12/24RCEo 6ED1052-2MD08-0BA2 All versions, LOGO! 230RCE 6ED1052-1FB08-0BA2 All versions, LOGO! 230RCEo 6ED1052-2FB08-0BA2 All versions, LOGO! 24CE 6ED1052-1CC08-0BA2 All versions, LOGO! 24CEo...

CVE-2025-40816

A vulnerability has been identified in LOGO! 12/24RCE 6ED1052-1MD08-0BA2 All versions V1.84.05, LOGO! 12/24RCEo 6ED1052-2MD08-0BA2 All versions V1.84.05, LOGO! 230RCE 6ED1052-1FB08-0BA2 All versions V1.84.05, LOGO! 230RCEo 6ED1052-2FB08-0BA2 All versions V1.84.05, LOGO! 24CE 6ED1052-1CC08-0BA2 Al...

CVE-2025-40816

A vulnerability has been identified in LOGO! 12/24RCE 6ED1052-1MD08-0BA2 All versions V1.84.05, LOGO! 12/24RCEo 6ED1052-2MD08-0BA2 All versions V1.84.05, LOGO! 230RCE 6ED1052-1FB08-0BA2 All versions V1.84.05, LOGO! 230RCEo 6ED1052-2FB08-0BA2 All versions V1.84.05, LOGO! 24CE 6ED1052-1CC08-0BA2 Al...

CVE-2025-40816

Siemens LOGO! 12/24RCE, LOGO! 230RCE, LOGO! 24CE and SIPLUS variants (all versions listed) are affected by CVE-2025-40816. Affected devices do not perform certain validations when interacting with them, which could allow an unauthenticated remote attacker to manipulate the device’s IP address, ma...

CVE-2025-40744

Summary: CVE-2025-40744 affects Solid Edge SE2025 prior to V225.0 Update 11, where the License Service endpoint fails to properly validate client certificates, enabling a potential man-in-the-middle for unauthenticated attackers. Both Red Hat and PT security sources confirm the issue and the affe...

Siemens LOGO! 访问控制错误漏洞

Siemens LOGO! is a programmable logic controller from Siemens, Germany. An Access Control Error vulnerability exists in Siemens LOGO! where an unauthenticated, remote attacker could manipulate the IP address of the device, rendering it inaccessible. The following products are affected:...

Siemens LOGO! 访问控制错误漏洞

Siemens LOGO! is a programmable logic controller from Siemens Germany. An access control error vulnerability exists in Siemens LOGO! that arises from the absence of certain authentication, which could allow an unauthenticated, remote attacker to alter the device's time, which could in turn affect...

CVE-2025-40816: Missing Authentication for Critical Function

A vulnerability has been identified in LOGO! 12/24RCE 6ED1052-1MD08-0BA2 All versions V1.84.05, LOGO! 12/24RCEo 6ED1052-2MD08-0BA2 All versions V1.84.05, LOGO! 230RCE 6ED1052-1FB08-0BA2 All versions V1.84.05, LOGO! 230RCEo 6ED1052-2FB08-0BA2 All versions V1.84.05, LOGO! 24CE 6ED1052-1CC08-0BA2 Al...

CVE-2025-40744: Improper Certificate Validation

A vulnerability has been identified in Solid Edge SE2025 All versions V225.0 Update 11. Affected applications do not properly validate client certificates to connect to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks...