PT-2025-23474 · Diviotec · Diviotec Professional Series

Name of the Vulnerable Software and Affected Versions: The Diviotec professional series affected versions not specified Description: The issue concerns the exposure of a web interface in the Diviotec professional series, where one endpoint is vulnerable to arbitrary command injection. Additionall...

PT-2025-23477 · Axis · Axis Device

Name of the Vulnerable Software and Affected Versions: Axis device affected versions not specified Description: A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web...

PT-2025-23473 · Netcomm · Netcom Ntc 6200 +1

Name of the Vulnerable Software and Affected Versions: Netcom NTC 6200 and NWL 222 series affected versions not specified Description: The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable to...

IBM UrbanCode Deploy XSS

The vulnerability of the software web interface for IBM UrbanCode Deploy UCD automation of application releases is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Exploit for Incorrect Default Permissions in Jrohy Trojan

Jrohy-trojan-RCE-POC Vulnerability Type: Command Injection R...

HashiCorp Vault XSS

The vulnerability of the web interface of the corporate information archiving platform, HashiCorp Vault and Vault Enterprise, is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks...

Evertz SDVN 3080ipx-10G security vulnerabilities

The Evertz SDVN 3080ipx-10G is a high-bandwidth Ethernet switching fabric for video applications from Evertz. A security vulnerability exists in the Evertz SDVN 3080ipx-10G that stems from a command injection and authentication bypass in the web management interface, which could lead to the...

CVE-2025-48827

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025...

Mobatime AMX MTAPI security vulnerability

Mobatime AMX MTAPI is a time recording and access control system from Mobatime, Inc. A security vulnerability exists in Mobatime AMX MTAPI version v6, which stems from a lack of authentication and authorization in the Web-API and could lead to unrestricted access to the network...

Cisco Identity Services Web Interface Cross-Site Scripting Vulnerability

Cisco Identity Services Engine is an identity-centric solution designed to provide comprehensive identity and access management IAM capabilities. A cross-site scripting vulnerability exists in the Cisco Identity Services web interface, which can be exploited by remote attackers to inject maliciou...

CVE-2025-20256

A vulnerability in the web-based management interface of Cisco Secure Network Analytics Manager and Cisco Secure Network Analytics Virtual Manager could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating...

CVE-2025-4008

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote...

CVE-2025-48417

The certificate and private key used for providing transport layer security for connections to the web interface TCP port 443 is hard-coded in the firmware and are shipped with the update files. An attacker can use the private key to perform man-in-the-middle attacks against users of the admin...

CVE-2025-48414

There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administrative/debug functionality and are likely intended for debugging during development and provides an additional attack surface...

CVE-2025-23055

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the...

CVE-2024-20462

A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, local attacker with low privileges to view passwords on an affected device. This vulnerability is due to incorrect sanitization of HTML conte...

CVE-2024-45103

A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges...

CVE-2024-24972

Buffer Copy without Checking Size of Input CWE-120 in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated operator to reboot the Controller, causing a Denial of Service. Gallagher recommend the diagnostic web page is not enabled default is off...

CVE-2024-45172

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to missing protection mechanisms, the C-MOR web interface is vulnerable to cross-site request forgery CSRF attacks. The C-MOR web interface offers no protection against cross-site request forgery CSRF attacks...

CVE-2024-7470

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been rated as critical. This issue affects the function sslvpnconfigmod of the file /vpn/vpntemplatestyle.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os...