CVE-2025-20620

SQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may obtain the administrative password of the web management page...

CVE-2025-20620

CVE-2025-20620 is a SQL Injection affecting STEALTHONE D220/D340 (and related models). The vulnerability could allow an unauthenticated attacker with network access to obtain the administrative password on the web management page. Root cause cited in a PT Security advisory points to lack of prote...

CVE-2024-12398

An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00ACLE.3 and WBE660S firmware versions through 6.70ACGG.2 could allow an authenticated user with limited privileges to escalate their privileges to that of an...

CVE-2024-12398

An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00ACLE.3 and WBE660S firmware versions through 6.70ACGG.2 could allow an authenticated user with limited privileges to escalate their privileges to that of an...

PT-2025-4793 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS versions AOS-8 through AOS-10 Description: An authenticated parameter injection vulnerability exists in the web-based management interface of the ArubaOS. Successful exploitation could allow an authenticated user to leverage parameter...

CVE-2025-22599 WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint `home.php` parameter `msg_c`

WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the home.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msgc parameter. This vulnerability is fixed in 3.2.8...

CVE-2025-20167

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...

CVE-2025-20168

Cisco Common Services Platform Collector (CSPC) web-based management interface is vulnerable to cross-site scripting (XSS) due to insufficient input validation. An authenticated, remote attacker with at least a low-privilege account can inject malicious code into specific pages to execute scripts...

CVE-2025-20167

CVE-2025-20167 (Cisco CSPC) describes a cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC). The issue stems from insufficient validation of user-supplied input in the interface. An attacker with at least a low-privileg...

CVE-2025-20167 Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...

CVE-2025-20167 Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...

PT-2025-1020 · Cisco · Cisco Crosswork Network Controller

Name of the Vulnerable Software and Affected Versions: Cisco Crosswork Network Controller affected versions not specified Description: The vulnerability exists in the web-based management interface of Cisco Crosswork Network Controller due to improper validation of user-supplied input. An...

PT-2025-1294 · Unknown · Stealthone D220 +2

Name of the Vulnerable Software and Affected Versions: STEALTHONE D220/D340/D440 affected versions not specified Description: A user with administrative privileges who logs in to the web management page of the affected product may execute an arbitrary OS command. The vulnerability is related to t...

PT-2025-1296 · Unknown · Stealthone D220/D340

Name of the Vulnerable Software and Affected Versions: STEALTHONE D220/D340 versions up to 6.03.02 Description: A SQL Injection vulnerability exists in the STEALTHONE D220/D340, allowing an attacker who can access the affected product to obtain the administrative password of the web management...

CVE-2024-13030

A vulnerability was found in D-Link DIR-823G 1.0.2B0520181207. It has been rated as critical. This issue affects the function SetAutoRebootSettings/SetClientInfo/SetDMZSettings/SetFirewallSettings/SetParentsControlInfo/SetQoSSettings/SetVirtualServerSettings of the file /HNAP1/ of the component W...

CVE-2024-13030

A vulnerability was found in D-Link DIR-823G 1.0.2B0520181207. It has been rated as critical. This issue affects the function SetAutoRebootSettings/SetClientInfo/SetDMZSettings/SetFirewallSettings/SetParentsControlInfo/SetQoSSettings/SetVirtualServerSettings of the file /HNAP1/ of the component W...

CVE-2024-13030 D-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings access control

A vulnerability was found in D-Link DIR-823G 1.0.2B0520181207. It has been rated as critical. This issue affects the function SetAutoRebootSettings/SetClientInfo/SetDMZSettings/SetFirewallSettings/SetParentsControlInfo/SetQoSSettings/SetVirtualServerSettings of the file /HNAP1/ of the component W...

CVE-2024-13030 D-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings access control

A vulnerability was found in D-Link DIR-823G 1.0.2B0520181207. It has been rated as critical. This issue affects the function SetAutoRebootSettings/SetClientInfo/SetDMZSettings/SetFirewallSettings/SetParentsControlInfo/SetQoSSettings/SetVirtualServerSettings of the file /HNAP1/ of the component W...

CVE-2024-13030

CVE-2024-13030 affects D-Link DIR-823G devices (firmware 1.0.2B05 20181207) via the Web Management Interface /HNAP1/ by manipulating SetAutoRebootSettings, SetClientInfo, SetDMZSettings, SetFirewallSettings, SetParentsControlInfo, SetQoSSettings, and SetVirtualServerSettings, leading to improper ...

D-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings Improper Access Control Vulnerability

The D-Link DIR-823G is a wireless router that provides network connectivity and management for homes and small offices. The D-Link DIR-823G suffers from an improper access control vulnerability that originates in the Web Management Interface component's SetAutoRebootSettings, SetClientInfo,...