17130 matches found
PT-2025-51103
The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an...
Unraid Web Interface Detection
Binary data unraidwebdetect.nbin...
CVE-2025-66473
XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of...
CVE-2025-41692
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm...
FreePBX SQL Injection Vulnerability (CNVD-2025-3038208)
FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. FreePBX suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered S...
CVE-2025-65231
Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting XSS in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page...
CVE-2025-41692
CVE-2025-41692 describes a high-privilege remote attack against a webUI where an admin user can brute-force the underlying OS root and user passwords due to a weak password generation algorithm. Connected sources (Red Hat and NVD/NVD-derived entries) indicate potential downstream risks: separate ...
CVE-2025-41692 Weak/Predictable root Password
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm...
PT-2025-49811
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm...
Siemens SIMATIC CN 4100 命令注入漏洞
The Siemens SIMATIC CN 4100 is a communication node from Siemens, Germany. The Siemens SIMATIC CN 4100 suffers from a command injection vulnerability that stems from insufficient validation of REST API input parameters, which can be exploited by an attacker to cause execution of arbitrary code...
EUVD-2025-201805
Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting XSS in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page...
EUVD-2025-201811
A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller firmware 1.5.1799...
CVE-2025-65230
Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting XSS vulnerability in the Web UI Configuration Streaming Destination input...
CVE-2025-14126
A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. Affected is an unknown function of the component Web Interface. Such manipulation leads to hard-coded credentials. The attack needs to be initiated within the local network. The exploit has been disclosed to the publi...
CVE-2025-65228
A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller firmware 1.5.1799...
CVE-2025-65229
Summary (CVE-2025-65229) : A stored XSS exists in Lyrion Music Server (≤ 9.0.3) via the web interface. An authenticated user with access to Settings → Player can save arbitrary HTML/JavaScript in the Player name field. The value is stored by the server and later rendered without proper output enc...
CVE-2025-65228
A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller firmware 1.5.1799...
Lyrion Music Server 安全漏洞
Lyrion Music Server is an audio server software from the Lyrion organization. A security vulnerability exists in Lyrion Music Server 9.0.3 and earlier versions, which stems from a lack of output coding in the web interface and could lead to stored cross-site scripting...