815 matches found
CVE-2025-34054
An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgiquery. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence wa...
CVE-2025-34066 AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure
An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle MITM attacks...
CVE-2025-20282
CVE-2025-20282 affects Cisco ISE and ISE-PIC. An unauthenticated attacker can exploit an internal API to upload arbitrary files via the vulnerable endpoint /api/v1/config/upload , bypassing validation and enabling the execution of those files on the host with root privileges. The issue arises fro...
CVE-2025-49132
Summary (CVE-2025-49132) Pterodactyl Panel versions up to 1.11.10 are affected by an unauthenticated remote code execution via the /locales/locale.json endpoint, where locale and namespace query parameters are passed to PHP include() unsafely. The vulnerability can lead to local file inclusion an...
WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Trฦฐฦกng Hแปฏu Phรบc truonghuuphuc in WordPress Plugin WP Visitor Statistics Real Time Traffic versions = 8.4...
WordPress Zagg theme <= 1.4.1 - Unauthenticated Local File Inclusion vulnerability
Unauthenticated Local File Inclusion vulnerability discovered by Phat RiO - BlueRock in WordPress Theme Zagg versions = 1.4.1...
CVE-2025-3302
The CVE-2025-3302 entry concerns Xagio SEO โ AI Powered SEO for WordPress. Affected are all versions up to and including 7.1.0.16, vulnerable to Unauthenticated Stored Cross-Site Scripting via HTTP_REFERER due to insufficient input sanitization and output escaping. The vulnerability was partially...
CVE-2025-3662
The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher Marc Montpas escalated it to an Unauthenticated Stored XSS...
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint
Summary An unauthenticated information disclosure vulnerability exists in the PSU deployment of HAX CMS via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to retrieve a full list of PSU websites hosted on HAX CMS. When chained with other authorization issues e.g., HAX-3...
Drupal COOKiES Consent Management module < 1.2.15 - Unauthenticated Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module COOKiES Consent Management versions 1.2.15...
CVE-2024-33517
An unauthenticated Denial-of-Service DoS vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service...
CVE-2024-33515
Unauthenticated Denial-of-Service DoS vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities results in the ability to interrupt the normal operation of the affected service...
CVE-2024-10314
In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service DoS via the auto-generation function was identified. Reported by Karol Wiฤsek...
CVE-2023-30754
Unauth. Reflected Cross-Site Scripting XSS vulnerability in AdFoxly AdFoxly โ Ad Manager, AdSense Ads & Ads.Txt plugin = 1.8.5 versions...
CVE-2023-47544
Unauth. Stored Cross-Site Scripting XSS vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management โ Atarim plugin = 3.12 versions...
CVE-2023-47517
Unauth. Reflected Cross-Site Scripting XSS vulnerability in SendPress Newsletters plugin = 1.23.11.6 versions...
CVE-2023-47665
Unauth. Reflected Cross-Site Scripting XSS vulnerability in edwardplainview Plainview Protect Passwords plugin = 1.4 versions...
CVE-2023-47518
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Matthew Muro Restrict Categories plugin = 2.6.4 versions...