4416 matches found
(Pwn2Own) Canon imageCLASS MF656Cdw sfpcmAuthenticateSecAdmin Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF656Cdw printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the sfpcmAuthenticateSecAdmin function. The issue results...
CVE-2025-5252 PHPGurukul News Portal Project edit-subadmin.php sql injection
A vulnerability was found in PHPGurukul News Portal Project 4.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit-subadmin.php. The manipulation of the argument emailid leads to sql injection. The attack can be initiated remotely. The exploit has...
CVE-2025-5251 PHPGurukul News Portal Project edit-subcategory.php sql injection
A vulnerability was found in PHPGurukul News Portal Project 4.1. It has been classified as critical. This affects an unknown part of the file /admin/edit-subcategory.php. The manipulation of the argument Category leads to sql injection. It is possible to initiate the attack remotely. The exploit...
CVE-2025-41653
CVE-2025-41653 affects Weidmueller Interface industrial Ethernet switches, with a DoS vulnerability in the device web server triggered by unauthenticated remote HTTP requests carrying a malicious header. Public details in connected records identify several affected models and versions: E-SW-VL08M...
PT-2025-22981 · Weidmueller · Ie-Sw-Pl10M-3Gt-7Tx +12
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A critical issue allows an unauthenticated remote attacker to execute arbitrary commands due to missing authentication on a critical function of the devices. This could potentially enable...
CVE-2025-5172 Econtrata valida sql injection
A vulnerability, which was classified as critical, was found in Econtrata up to 20250516. Affected is an unknown function of the file /valida. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the publi...
CVE-2025-5160
CVE-2025-5160 (H3C SecCenter SMP-E1114P02) affects the Download function at /packetCaptureStrategy/download. The vulnerability arises from manipulation of the Name argument, causing path traversal. It is exploitable remotely, and public exploits have been disclosed. Multiple sources confirm the a...
CVE-2025-5133 Tmall Demo Search Box cross site scripting
A vulnerability classified as problematic has been found in Tmall Demo up to 20250505. Affected is an unknown function of the component Search Box. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be...
CVE-2025-5127 Teledyne FLIR AX8 prod.php cross site scripting
A vulnerability was determined in Teledyne FLIR AX8 up to 1.46.16. This issue affects some unknown processing of the file /prod.php. Executing manipulation of the argument cmd can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be...
PT-2025-22841 · Flir · Flir Ax8
Name of the Vulnerable Software and Affected Versions: FLIR AX8 versions up to 1.46.16 Description: A critical vulnerability was found in FLIR AX8, affecting the setDataTime function of the file usrwwwapplicationmodelssettingsregional.php. The manipulation of the arguments year, month, day, hour,...
CVE-2025-21568
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Access and Security. The supported version that is affected is 11.2.19.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...
CVE-2025-0734
A vulnerability has been found in yproject RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component Whitelist. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public an...
CVE-2025-0537
A vulnerability, which was classified as problematic, has been found in code-projects Car Rental Management System 1.0. This issue affects some unknown processing of the file /admin/manage-pages.php. The manipulation of the argument pgdetails leads to cross site scripting. The attack may be...
CVE-2025-0479
This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system. Successful exploitation of this...
CVE-2025-0871
A vulnerability classified as problematic has been found in Maybecms 1.2. This affects an unknown part of the file /mb/admin/index.php?u=article-edit of the component Add Article. The manipulation of the argument datainfocontent leads to cross site scripting. It is possible to initiate the attack...
CVE-2024-9300
A vulnerability classified as problematic was found in SourceCodester Online Railway Reservation System 1.0. This vulnerability affects unknown code of the file contactus.php of the component Message Us Form. The manipulation of the argument fullname/email/message leads to cross site scripting. T...
CVE-2024-8144
A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Logo Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been...
CVE-2024-31634
Cross Site Scripting XSS vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library...
CVE-2024-3433
A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register.php. The manipulation of the argument eventid/fullname/email/mobile/college/branch leads to cross site scripting. It is possible to launch...