CVE-2025-65007 Missing Authentication for Critical Function in WODESYS WD-R608U router

In WODESYS WD-R608U router also known as WDR122B V2.0 and WDR28 due to lack of authentication in the configuration change module in the adm.cgi endpoint, the unauthenticated attacker can execute commands including backup creation, device restart and resetting the device to factory settings. The...

PT-2025-52249

WODESYS WD-R608U router also known as WDR122B V2.0 and WDR28 is vulnerable to Broken Access Control in initial configuration wizard.cgi endpoint. Malicious attacker can change admin panel password without authorization. The vulnerability can also be exploited after the initial configuration has...

CVE-2025-14220 ORICO CD3510 File Upload path traversal

A security vulnerability has been detected in ORICO CD3510 1.9.12. This affects an unknown function of the component File Upload. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early...

CVE-2025-14108

A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2api.OpenSafe of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation of the argument safedir causes command injection. It is possible to initiate...

CVE-2025-14106

A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safedir leads to command injection. The attack is possible to be carried o...

PT-2025-49023

Name of the Vulnerable Software and Affected Versions XunRuiCMS versions up to 4.7.1 Description A flaw exists in XunRuiCMS that allows for cross site scripting. This issue is located in the file /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=0, specifically within the Add Display Nam...

CVE-2025-12465

A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks. The vendor was notified early about this vulnerability, but didn't respond with the details of...

CVE-2025-13799 ADSLR NBR1005GPEV2 send_order.cgi ap_macfilter_del command injection

A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function apmacfilterdel of the file /sendorder.cgi. The manipulation of the argument mac leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to...

EUVD-2025-197996

Windu CMS is vulnerable to User Enumeration. This issue occurs during logon, where a difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins. The vendor was notified early about this vulnerability, but didn't respon...

CVE-2025-59111

CVE-2025-59111 : Windu CMS is affected by Broken Access Control in the user editing functionality. A privileged attacker can issue a GET request to delete Super Admins, an action not possible via the GUI. The issue has been tested only on version 4.1 and is fixed in version 4.1 build 2250. Other ...

EUVD-2025-197995

Windu CMS is vulnerable to multiple Stored Cross-Site Scripting XSS vulnerabilities in the page editing endpoint windu/admin/content/pages/edit/. This vulnerability can be exploited by a privileged user and may target users with higher privileges. The vendor was notified early about this...

CVE-2025-59114 Cross-Site Request Forgery in Windu CMS

Windu CMS is vulnerable to Cross-Site Request Forgery in file uploading functionality. Malicious attacker can craft special website, which when visited by the victim, will automatically send malicious file to the server. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixe...

CVE-2025-59110

CVE-2025-59110: Windu CMS is affected by a Cross-Site Request Forgery in the user editing functionality. The fix relies on CSRF protection, but the protection can be bypassed using a CSRF token from another user. Open registration means attacker possibilities may be broader. Affected: Windu CMS v...

CVE-2025-9982

A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege...

CVE-2025-10018

QuickCMS is vulnerable to multiple Stored XSS in language editor functionality languages. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. Th...

PT-2025-43937

Name of the Vulnerable Software and Affected Versions LearnHouse versions prior to 98dfad76aad70711a8113f6c1fdabfccf10509ca Description A cross site scripting issue exists in LearnHouse. The issue is located in the Account Setting Page component, specifically within the file...

PT-2025-43760

Name of the Vulnerable Software and Affected Versions ajayrandhawa User-Management-PHP-MYSQL web affected versions not specified Description A security flaw exists in ajayrandhawa User-Management-PHP-MYSQL web. The issue involves cross-site request forgery, allowing remote attackers to perform...

PT-2025-43877

Name of the Vulnerable Software and Affected Versions Bdtask Flight Booking Software versions prior to 3.2 Description A flaw exists in Bdtask Flight Booking Software that allows for unrestricted file uploads. This issue affects the Package Information Module, specifically within the...

CVE-2025-9981

CVE-2025-9981 refers to QuickCMS with Stored XSS in the slider editor (sliders-form). The Red Hat and NVD/CIRCL entries confirm this vulnerability affects QuickCMS 6.8 as tested; other versions are not verified and may also be affected. By design, an admin can inject arbitrary HTML/JS, which is r...

EUVD-2025-35661

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality sliders-form. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website. T...