CVE-2025-50881

The flow/admin/moniteur.php script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handling GET requests, the script takes user-supplied input from the action URL parameter, performs insufficient validation, and incorporates this input into a strin...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-1609)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to exe...

Exploit for Path Traversal in Apache Http_Server

exploitApac...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-006142)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006142 advisory. An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures 30 days in default configurations, to the backoff timer becoming...

EUVD-2019-19737

Easy File Sharing Web Server 7.2 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by creating a malicious username. Attackers can craft a username with a payload containing 4059 bytes of padding followed by a nseh...

CVE-2026-3955

A security vulnerability has been detected in elecV2P up to 3.8.3. Affected by this issue is the function runJSFile of the file source-code/elecV2P-master/webser/wbjs.js of the component jsfile Endpoint. Such manipulation leads to code injection. The attack may be launched remotely. The exploit h...

CVE-2019-25472

Intelbras Telefone IP TIP200 and TIP200 LITE are affected by an unauthenticated arbitrary file read via the dumpConfigFile function in /cgi-bin/cgiServer.exx. By sending a GET request to /cgi-bin/cgiServer.exx with the command parameter containing dumpConfigFile(), attackers can read sensitive fi...

CVE-2019-25466 Easy File Sharing Web Server 7.2 Local SEH Overflow

Easy File Sharing Web Server 7.2 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by creating a malicious username. Attackers can craft a username with a payload containing 4059 bytes of padding followed by a nseh...

Coppermine Photo Gallery（CPG） 路径遍历漏洞

Coppermine Photo Gallery CPG is a web-based album management system developed by the Coppermine team using PHP. This system offers features such as user management, password-based access to albums, and automatic thumbnail generation. Versions of Coppermine Photo Gallery prior to 1.6.27 had a path...

PT-2026-24764

Easy File Sharing Web Server 7.2 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by creating a malicious username. Attackers can craft a username with a payload containing 4059 bytes of padding followed by a nseh...

Easy File Sharing Web Server 缓冲区错误漏洞

Easy File Sharing Web Server is an open-source file sharing server developed by Easy File Server. Version 7.2 of Easy File Sharing Web Server contains a buffer error vulnerability, which stems from an issue with handling local structured data exceptions, leading to a buffer overflow. This...

EUVD-2025-208470

An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result of incorrect permission assignment for the web server...

EUVD-2025-208500

CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server...

CVE-2026-24641

A NULL Pointer Dereference vulnerability CWE-476 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker to crash the HTTP daemon via crafted HTTP...

CVE-2025-41712

An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result of incorrect permission assignment for the web server...

CVE-2025-13902

CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server...

CVE-2025-13902

CVE-2025-13902 describes a Cross-site Scripting (CWE-79) vulnerability that can allow an authenticated attacker to cause a victim’s browser to execute arbitrary JavaScript when the victim visits a page containing a crafted element with the injected payload. The CVSS score is 5.1 (Medium) with NET...

CVE-2025-13902

CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server...

CVE-2026-24641

CVE-2026-24641 describes a NULL pointer dereference in Fortinet FortiWeb that can crash the HTTP daemon via crafted HTTP requests. Affected: FortiWeb 8.0.0–8.0.2; 7.6.0–7.6.6; 7.4 (all versions); 7.2 (all versions); 7.0 (all versions). Impact: availability disruption (HTTP daemon crash) with auth...

CVE-2025-41712 Incorrect Permission Assignment on power analyzer

An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result of incorrect permission assignment for the web server...