Tenda AC18 安全漏洞

Tenda AC18 is a dual-band wireless router launched by Shenzhen Jixiang Tenda Technology Co. in July 2016, mainly for villas and large home users. Tenda AC18 suffers from a weak password vulnerability that originates from a code flaw in the /etcro/smb.conf file in the Samba component. No detailed...

PT-2025-30970 · Tenda +1 · Tenda Ac18 +1

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.19 Description: A vulnerability exists in the Tenda AC18 device due to weak password requirements. The issue affects unknown code within the /etc ro/smb.conf file of the Samba component and can be exploited remotel...

CVE-2025-7948

A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/user/updatePwd. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2025-7948

CVE-2025-7948 affects jshERP up to version 3.5. The vulnerability is due to a weakness in the handling of the file /jshERP-boot/user/updatePwd, leading to weak password recovery. It can be exploited remotely and the exploit has been publicly disclosed. Affected versions are up to 3.5; remediation...

PT-2025-30368 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP versions up to 3.5 Description: A problematic issue exists in jshERP that affects an unknown functionality of the file /jshERP-boot/user/updatePwd. This manipulation results in weak password recovery and can be exploited remotely. The...

jshERP 授权问题漏洞

jshERP Huaxia ERP is a homegrown ERP system by the individual developer of China's Ji Sheng Hua. An authorization issue vulnerability exists in jshERP 3.5 and earlier versions, which stems from a weak password recovery due to incorrect operation of the file /jshERP-boot/user/updatePwd...

CVE-2025-7881

A vulnerability was found in Mercusys MW301R 1.0.2 Build 190726 Rel.59423n. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument code leads to weak password recovery. The attack can be initiated remotely. The...

PT-2025-30183 · Mercusys · Mercusys Mw301R

Name of the Vulnerable Software and Affected Versions: Mercusys MW301R version 1.0.2 Build 190726 Rel.59423n Description: A vulnerability exists in the Web Interface component of Mercusys MW301R. Manipulation of the code argument allows for weak password recovery, and the attack can be initiated...

CVE-2025-7789 Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with...

CVE-2025-7789 Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with...

CVE-2025-7789

Summary of CVE-2025-7789 : The issue affects the xxl-job framework (versions up to 3.1.1). The vulnerable component is the makeToken function in IndexController.java (Token Generation). The root cause is password hashing with insufficient computational effort, enabling a remote attack; exploitati...

CVE-2025-7789 Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with...

Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai

Security researchers recently revealed that the personal information of millions of people who applied for jobs at McDonald 's was exposed after they guessed the password "123456" for the fast food chain's account at Paradox.ai , a company that makes artificial intelligence based hiring chatbots...

CVE-2025-5022

Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product measurement unit and display unit to...

CVE-2025-5022

Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product measurement unit and display unit to...

CVE-2025-5022

CVE-2025-5022 affects Mitsubishi Electric Corporation’s photovoltaic system monitor “EcoGuideTAB” PV-DR004J (all versions) and PV-DR004JA (all versions). The vulnerability is described as a weak password requirement that enables an attacker within the Wi‑Fi range between the measurement unit and ...

CVE-2025-5022

Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product measurement unit and display unit to...

Mitsubishi Electric PV-DR004J 安全漏洞

Mitsubishi Electric PV-DR004J is a solar power generator from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric PV-DR004J that stems from a weak password requirement that could lead to the derivation of a password...

Brute Force

Overview Affected versions of this package are vulnerable to Brute Force due to the lack of password policy and brute-force protection in the authentication process. An attacker can gain unauthorized access to user accounts by performing automated brute-force attacks. Remediation Upgrade...

Norwegian Dam Valve Forced Open for Hours in Cyberattack

Unidentified hackers breached a Norwegian dam's control system in April, opening its valve for hours due to a weak password. Learn how simple vulnerabilities threaten critical infrastructure...