Light & Wonder Deck Mate 安全漏洞

Light & Wonder Deck Mate is an automated licensing device from Light & Wonder UK. A security vulnerability exists in the Light & Wonder Deck Mate that stems from the use of hard-coded credentials and the enabling of multiple management services by default, which could lead to unauthorized...

CVE-2023-53689

Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting XSS vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly...

CVE-2025-10317 Multiple Cross-Site Request Forgery in Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request creating a malicious product with content defined by the attacker. This software does not...

PT-2025-44453

Name of the Vulnerable Software and Affected Versions Each Italy Wireless Mini Router WIRELESS-N 300M version v28K.MiniRouter.20190211 Description A flaw exists in the web management interface of the affected router that allows unauthorized modification of the administrator username and password...

CVE-2025-12351 Inadequate access control measure allows unauthorized users to access restricted administrative functions

Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of...

Exploit for Improper Input Validation in Atlassian Confluence_Data_Center

LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0...

Access Control Bypass

Overview @kottster/server is an Instant admin panel for your project Affected versions of this package are vulnerable to Access Control Bypass via the initApp and installPackagesForDataSource actions. An attacker can gain unauthorized administrative access and execute arbitrary system commands by...

CVE-2025-6892

An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allows unauthorized access to protected API endpoints, including those intended for administrative functions. This vulnerability can be...

Missing Authorization

Overview melisplatform/melis-core is a Melis Platform Core module Affected versions of this package are vulnerable to Missing Authorization via the /melis/MelisCore/ToolUser/addNewUser endpoint. An attacker can gain unauthorized administrative access by sending a crafted request to this endpoint...

EUVD-2018-8187

Malware in sbrugna...

EUVD-2024-53610

Malicious code in bioql PyPI...

EUVD-2025-25726

Malicious code in bioql PyPI...

EUVD-2025-25065

Malicious code in bioql PyPI...

CVE-2025-54875 FreshRSS: Unauthorized creation of admin user when registration is enabled

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, newuserisadmin. This is fixed in version...

The vulnerability of the sub_478D28 function in D-Link DI-7400G+ router microprogramming software allows a hacker to gain unauthorized access to the administrator interface.

The vulnerability of function sub478D28 in the D-Link DI-7400G+ router’s microprogramming system is related to the lack of measures taken to neutralize certain special elements. Exploiting this vulnerability can allow an intruder to gain unauthorized access to the administrator interface...

Cognex In-Sight Explorer和Cognex In-Sight Camera Firmware 安全漏洞

Cognex In-Sight Explorer and Cognex In-Sight Camera Firmware are both products of Cognex Corporation, U.S.A. Cognex In-Sight Explorer is a tool that has the ability to debug and program the software of its line of smart cameras.Cognex In-Sight Camera Firmware is the firmware for a range of smart...

CVE-2025-59416 The Scratch Channel forks can publish articles

The Scratch Channel is a news website. If the user makes a fork, they can change the admins and make an article. Since the API uses a POST request, it will make an article. This issue is fixed in v1.2...

cups: Authentication Bypass in CUPS Authorization Handling

A flaw was found in CUPS, a widely used printing service on Linux and UNIX-like systems. The issue arises when authentication is configured to use a method other than Basic, but the attacker sends an HTTP request with a Basic authentication header. Due to improper validation in the cupsdAuthorize...

CVE-2025-52352

The Aikaan IoT management platform v3.25.0325-5-g2e9c59796 is vulnerable to an authentication bypass because the sign-up API endpoint remains functional even when the sign-up option is disabled in the user interface. This allows unauthenticated users to register new accounts via the API, potentia...

CVE-2025-55736

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges e.g. delete users, posts, comments etc.. The problem is in the routes/adminPanelUsers file...