CVE-2025-2096

A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This vulnerability affects the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mode/week/minute/recHour leads to os command injection. The attack can be initiat...

CVE-2025-26202

Cross-Site Scripting XSS vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings 2.4GHz & 5GHz bands in DZS Router Web Interface. An authenticated attacker can inject malicious JavaScript into the passphrase field, which is stored and later executed when an...

PT-2025-41790

Уязвимость веб-интерфейса веб-сервера ЭЛАРА Эликонт-КС связана с отсутствием фильтрации передаваемого клиентом пути. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к защищаемой информации...

CVE-2025-20208

A vulnerability in the web-based management interface of Cisco TelePresence Management Suite TMS could allow a low-privileged, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based...

CVE-2025-23410

When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types...

Aruba Networks ClearPass Policy Manager Command Execution

The vulnerability of the Aruba Networks ClearPass Policy Manager’s web interface is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

NAKIVO Backup and Replication Disclosure Information

The vulnerability of the web interface of NAKIVO Backup and Replication systems for virtual machines involves access control deficiencies. Exploiting this vulnerability allows an attacker to disclose protected information by sending specially crafted HTTP requests...

Tenda AC7 Router FormSetFirewallCfg Code Execution

The vulnerability of the formSetFirewallCfg function in the web interface of the Tenda AC7 router’s microprogramming software is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted POST reque...

Linux Distros Unpatched Vulnerability : CVE-2023-34237

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the...

CVE-2025-23410 GMOD Apollo Relative Path Traversal

When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types...

CVE-2025-23410

When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types...

CVE-2025-23410

When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types...

CVE-2025-23410 GMOD Apollo Relative Path Traversal

When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types...

CVE-2024-47262

Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the web interface of the Axis device. Other API endpoints or services not making use of param.cgi are not...

PT-2025-9632

Name of the Vulnerable Software and Affected Versions DZS Router Web Interface affected versions not specified Description A Cross-Site Scripting XSS issue exists in the WPA/WAPI Passphrase field of the Wireless Security settings for both 2.4GHz and 5GHz bands. An authenticated attacker can injec...

AXIS OS security vulnerabilities

AXIS OS is an edge device operating system from the Swedish company Axis AXIS. AXIS OS has a security vulnerability that stems from a competitive condition that could block web interface access...

CVE-2025-26202: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings 2.4GHz & 5GHz bands in DZS Router Web Interface. An authenticated attacker can inject malicious JavaScript into the passphrase field, which is stored and later executed when an...

Linux Distros Unpatched Vulnerability : CVE-2014-5031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information v...

Linux Distros Unpatched Vulnerability : CVE-2018-4300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web...

PT-2025-9724

Name of the Vulnerable Software and Affected Versions GMOD Apollo affected versions not specified Description The issue arises when uploading organism or sequence data via the web interface. GMOD Apollo unzips and inspects the files without checking for path traversal in supported archive types...