Denial Of Service (DoS)

octoprint is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of malformed multipart/form-data requests due to an endless loop triggered by a missing end boundary, which causes the single-threaded Tornado web server to become unresponsive...

PT-2025-25192 · Apache · Apache Web Server

Name of the Vulnerable Software and Affected Versions: Apache Web Server affected versions not specified Description: The issue concerns unvalidated user input. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue...

CVE-2025-48879

OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. The issue can be triggered by a broken...

CVE-2025-5740

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause arbitrary file writes when an authenticated user on the web server manipulates file path...

CVE-2025-5742

CWE-79: Improper Neutralization of Input During Web Page Generation ‘Cross-site Scripting’ vulnerability exists when an authenticated user modifies configuration parameters on the web server...

CVE-2025-3899

CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in Certificates page on Webserver that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser...

CVE-2025-5742

CWE-79: Improper Neutralization of Input During Web Page Generation ‘Cross-site Scripting’ vulnerability exists when an authenticated user modifies configuration parameters on the web server...

CVE-2025-5742

CVE-2025-5742 : A cross-site scripting vulnerability exists in Schneider Electric EVLink WallBox. An authenticated user who modifies configuration parameters on the web server can trigger improper input neutralization during web page generation, potentially enabling XSS. Publicly available detail...

CVE-2025-5741

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause arbitrary file reads from the charging station. The exploitation of this vulnerability does require an authenticated session of the web server...

CVE-2025-5907

A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232B20210713. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The...

PT-2025-24628 · Schneider Electric · Modicon Controllers M241/M251 +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A Denial of Service issue exists due to improper input validation. This occurs when an authenticated malicious user sends an HTTPS request containing an invalid data type to the web server...

CVE-2025-30183

CyberData 011209 Intercom does not properly store or protect web server admin credentials...

CVE-2025-30183

CyberData 011209 Intercom does not properly store or protect web server admin credentials...

CVE-2025-30183

CVE-2025-30183 – CyberData 011209 Intercom : The Connected documents corroborate a vulnerability where the Intercom web interface may be accessed without authentication via an alternate path, enabling potential disclosure of sensitive data, denial of service, or even code execution. Root cause: i...

CVE-2025-30183 CyberData 011209 SIP Emergency Intercom Insufficiently Protected Credentials

CyberData 011209 Intercom does not properly store or protect web server admin credentials...

HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

Summary An authenticated Local File Inclusion LFI vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as...

The vulnerability of the built-in web server boa (/boafrm/formWsc) of TOTOLINK X15 router’s microprogramming software allows a intruder to execute arbitrary commands or cause a service failure.

The vulnerability of the built-in web server boa /boafrm/formWsc of TOTOLINK X15 routers is related to the issue where the operation’s output goes beyond the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

The vulnerability in the built-in web server boa (/boafrm/formReflashClientTbl) of TOTOLINK X15 router microprogramming software allows a perpetrator to execute arbitrary commands or cause a service failure.

The vulnerability of the built-in web server software boa /boafrm/formReflashClientTbl of TOTOLINK X15 routers is related to the issue where the operation exceeds the buffer limits in memory when processing the submit-url parameter. Exploiting this vulnerability allows a remote attacker to execut...

The vulnerability of the built-in web server boa (/boafrm/formIpQoS) of TOTOLINK X15 router’s microprogramming software allows a intruder to execute arbitrary commands or cause a service failure.

The vulnerability of the built-in web server boa /boafrm/formIpQoS of TOTOLINK X15 router software is related to the issue of the operation exceeding the buffer in memory when processing the mac parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands or cau...

The vulnerability in the built-in web server boa (/boafrm/formWirelessTbl) of TOTOLINK X15 router microprogramming software allows a intruder to execute arbitrary commands or cause a service failure.

The vulnerability of the built-in web server boa /boafrm/formWirelessTbl of TOTOLINK X15 router microprogramming software is related to the issue where the operation results are written out of the buffer into memory when processing the submit-url parameter. Exploiting this vulnerability allows a...