PT-2026-97042

Name of the Vulnerable Software and Affected Versions Autonomy Logic OpenPLC version 3 Description An improper neutralization of input during web page generation occurs in the web interface when routing programs based on a query string parameter that is not encoded. This cross-site scripting XSS...

PT-2026-96152

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260717 Description An authentication bypass exists in the web-based network traffic monitoring application where the endpoint "/lua/rest/v2/edit/system/edit blacklist.lua" fails to verify administrator privileges...

FMD Android v0.17.0

FMD Android Find your device via SMS, instant messengers, or a web interface FMD Server. FMD allows you to locate, ring, wipe and issue other commands to your device when it's lost. It aims to be a secure open source alternative to Google's Find My Device. Why? I lost my brand new phone last week...

wingdata

Wingdata — HackTheBox ウォークスルー プラットフォーム: HackTheBox | OS: Linux 攻撃チェーン VHost 列挙で WingFTP サーバーを発見。CVE-2025-47812 のコマンドインジェクションで初期アクセスを取得。root 権限は、細工された tar アーカイブを展開する sudo Python リストアスクリプトを経由して取得 — tar のパストラバーサルにより root として任意のファイルを書き込む。 列挙 root@kitploit: nmap -sC -sV wingdata.htb -Pn 22/tcp open ss...

The vulnerability of the REST API web interface component based on artificial intelligence allows a hacker to induce a service failure.

The vulnerability of the REST API web interface component based on artificial intelligence is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

The vulnerability in the web interface for managing Tenda AC7 router micro-programming software allows a hacker to inject any HTML or JavaScript code they desire.

The vulnerability in the web interface for managing Tenda AC7 router micro-programming software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML or JavaScript code remotely...

easywall v2.20.1

easywall Your firewall. Your rules. No surprises. Live demo · Documentation · Changelog nftables through a web interface that cannot lock you out: every apply reverts itself unless you confirm it. The idea Editing a rule changes nothing. Applying it changes everything — for 120 seconds. If the ne...

CVE-2026-76431 Cisco Identity Services Engine Arbitrary File Deletion Vulnerability

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid...

EUVD-2026-81161

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could...

CVE-2026-20344

Cisco Secure Firewall Management Center (FMC) Software contains a SQL injection vulnerability in its web-based management interface, caused by insufficient validation of user-supplied input. An authenticated remote attacker holding the Security Approver , Access Admin , or Network Admin role can ...

CVE-2026-20350 Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability

A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface...

EUVD-2026-80886

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative...

Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability

A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface...

Security Bulletin: The IBM Platform RTM is affected by an SQL injection vulnerability (CVE-2026-17619)

Summary The IBM Platform RTM takes an input in web interface directly for SQL Query, unvalidated value might allow bad actor to insert malicious code into the SQL Query phase. Vulnerability Details CVEID:CVE-2026-17619 DESCRIPTION: IBM Platform RTM is vulnerable to SQL injection. A remote attacke...

CVE-2026-73176

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-73165

Nozomi Networks Labs identified an OS command injection (CWE-78) vulnerability in the web management interface of the Advantech EKI-1242IEIMS industrial Ethernet switch running firmware V1.06.01 . A remote authenticated attacker can execute arbitrary OS commands as root by sending crafted request...

CVE-2026-89207

A vulnerability has been identified in WTV676-HB6035 Web Interface All versions V3.94, WTV776-HB6035 Web Interface All versions V4.17. Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into...

CVE-2026-89207

A vulnerability has been identified in WTV676-HB6035 Web Interface All versions V3.94, WTV776-HB6035 Web Interface All versions V4.17. Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into...

CVE-2026-89207

CVE-2026-89207 affects the web interfaces of the Siemens WTV676-HB6035 (all versions < V3.94) and WTV776-HB6035 (all versions

PT-2026-93362

Name of the Vulnerable Software and Affected Versions WTV676-HB6035 Web Interface versions prior to V3.94 WTV776-HB6035 Web Interface versions prior to V4.17 Description Devices fail to properly validate input received from backend services. This flaw allows an unauthenticated remote attacker to...