EUVD-2025-12577

Malicious code in bioql PyPI...

EUVD-2025-23923

Malicious code in bioql PyPI...

CVE-2025-9816

CVE-2025-9816 : WP Statistics for WordPress is affected by unauthenticated Stored Cross‑Site Scripting via the User‑Agent header in all versions up to 14.5.4. Root cause: insufficient input sanitization and output escaping. Impact: arbitrary script injection executed when users load injected page...

FreePBX ajax.php unauthenticated SQLi to RCE

This module exploits an unauthenticated SQL injection flaw in FreePBX prior to versions 15.0.66, 16.0.89, and 17.0.3. The vulnerability lies in the /admin/ajax.php endpoint, which is accessible without authentication. Additionally, the database user created by FreePBX can schedule cronjobs,...

CVE-2025-8289 Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the deleteassociatedfiles function. This makes it possible for unauthenticated attackers to inject a PHP Object. This...

WordPress Add User Meta plugin <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Add User Meta versions = 1.0.1...

CVE-2025-34152

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike othe...

CVE-2025-34152

The CVE-2025-34152 entry concerns the Shenzhen Aitemi M300 Wi‑Fi Repeater (MT02). The vulnerability is an unauthenticated OS command injection exposed via the time parameter of the /protocol.csp? endpoint. Reported impact is remote code execution with root privileges without requiring authenticat...

CVE-2013-10069

The web interface of multiple D-Link routers, including DIR-600 rev B ≤2.14b01 and DIR-300 rev B ≤2.13, contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to...

CVE-2014-125124

An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell...

CVE-2014-125123 Kloxo < 6.1.12 Unauthenticated SQL Injection RCE

An unauthenticated SQL injection vulnerability exists in the Kloxo web hosting control panel developed by LXCenter prior to version 6.1.12. The flaw resides in the login-name parameter passed to lbin/webcommand.php, which fails to properly sanitize input, allowing an attacker to extract the...

CVE-2025-7724

An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

CVE-2018-25113 Dicoogle PACS Web Server 2.5.0 Unauthenticated Path Traversal

An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter...

CVE-2018-25113

Dicoogle PACS Web Server (version 2.5.0 and earlier) is affected by an unauthenticated path traversal flaw. A crafted request to the /exportFile endpoint using the UID parameter can cause the server to read arbitrary files on the underlying system, exposing sensitive data accessible to the web se...

PT-2025-30584 · Unknown · Dicoogle Pacs Web Server

Name of the Vulnerable Software and Affected Versions: Dicoogle PACS Web Server versions 2.5.0 and earlier Description: An unauthenticated path traversal vulnerability exists that allows remote attackers to read arbitrary files on the underlying system. Exploitation occurs by sending a crafted...

CVE-2025-7724

An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

CVE-2025-7724 Unauthenticated command injection on VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2

An unauthenticated OS command injection vulnerability exists in VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2.This issue affects VIGI NVR1104H-4P V1: before 1.1.5 Build 250518; VIGI NVR2016H-16MP V2: before 1.3.1 Build 250407...

CVE-2025-7724

This CVE affects TP-Link VIGI NVR1104H-4P V1 and VIGI NVR2016H-16MP V2. The JVN entry confirms an unauthenticated OS command injection (CVE-2025-7724) in these devices. Affected versions are VIGI NVR1104H-4P V1 prior to 1.1.5 Build 250518 and VIGI NVR2016H-16MP V2 prior to 1.3.1 Build 250407. The...

CVE-2025-50107

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Request handling. Supported versions that are affected are 12.2.5-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal Wo...

CVE-2024-26291

An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allowing users to read arbitrary files. As the application runs with the highest privileges root/NTAUTHORITY SYSTEM by default attackers are ab...