CVE-2025-2620 D-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflow

A vulnerability has been found in D-Link DAP-1620 1.03 and classified as critical. This vulnerability affects the function modgraphauthurihandler of the file /storage of the component Authentication Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated...

CVE-2025-2620

CVE-2025-2620 is a stack-based buffer overflow in D-Link DAP-1620 firmware 1.03, within the mod_graph_auth_uri_handler function under /storage. Multiple sources confirm remote exploitation potential and high impact (DoS and possible RCE) on a no-longer-supported device. A PoC exploit repository e...

CVE-2025-2618

A vulnerability, which was classified as critical, has been found in D-Link DAP-1620 1.03. Affected by this issue is the function setwsaction of the file /dws/api/ of the component Path Handler. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit...

CVE-2025-2619

A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function checkdwscookie of the file /storage of the component Cookie Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit h...

CVE-2025-2619

A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function checkdwscookie of the file /storage of the component Cookie Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit h...

CVE-2025-2619

CVE-2025-2619 affects D-Link DAP-1620 (firmware 1.03) and targets the check_dws_cookie function in the Cookie Handler’s /storage path. The weakness is a stack-based buffer overflow triggered by improper input length validation, allowing remote exploitation. Multiple sources corroborate critical s...

CVE-2025-2619 D-Link DAP-1620 Cookie storage check_dws_cookie stack-based overflow

A vulnerability, which was classified as critical, was found in D-Link DAP-1620 1.03. This affects the function checkdwscookie of the file /storage of the component Cookie Handler. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit h...

CVE-2025-2618

The CVE-2025-2618 vulnerability affects D-Link DAP-1620 firmware 1.03, specifically the Path Handler’s set_ws_action function in /dws/api/. It enables a heap-based buffer overflow that can be triggered remotely; the exploit has been disclosed publicly. The issue reportedly affects products no lon...

CVE-2025-2618 D-Link DAP-1620 Path api set_ws_action heap-based overflow

A vulnerability, which was classified as critical, has been found in D-Link DAP-1620 1.03. Affected by this issue is the function setwsaction of the file /dws/api/ of the component Path Handler. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit...

CVE-2025-26796

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...

CVE-2025-26796 Apache Oozie: XSS in Oozie Web Console

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...

CVE-2025-26796 Apache Oozie: XSS in Oozie Web Console

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Oozie. This issue affects Apache Oozie: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended t...

CVE-2025-26796

CVE-2025-26796 concerns Apache Oozie, stating a Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The vulnerability affects Apache Oozie across all versions and, per the sources, the project is retired with no planned patch; users are ...

CVE-2024-12016

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CM Informatics CM News allows SQL Injection. This issue affects CM News: through 6.0. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2025-29980

A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.7...

CVE-2025-29980 Blind SQL Injection vulnerability in eTRAKiT.Net

A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.7...

CVE-2025-2553 D-Link DIR-618/DIR-605L formVirtualServ access control

A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /goform/formVirtualServ. The manipulation leads to improper access controls. The attack needs to be approached within the local network. The...

CVE-2025-2553

Affected products: D-Link DIR-618 and DIR-605L (firmware 2.02/3.02). Issue: Access control error in the /goform/formVirtualServ handling, caused by improper access controls. Impact: local-network exposure risk due to manipulation of virtual services. Exploitability: exploit publicly disclosed; pr...

CVE-2025-2552

A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/formTcpipSetup. The manipulation leads to improper access controls. Access to the local network is required for this attack to...

CVE-2025-2551

A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been classified as problematic. This affects an unknown part of the file /goform/formSetPortTr. The manipulation leads to improper access controls. Access to the local network is required for this attack. The exploit has...