CVE-2026-30695: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, including XA4, X3/X3BIO, X4, X7, and XIO / i-door / i-door+. The vulnerability is caused by improper sanitization of user-supplied input in the dirBrowse parameter o...

CVE-2025-15258: URL Redirection to Untrusted Site

A weakness has been identified in Edimax BR-6208AC 1.02/1.03. Affected by this issue is the function formALGSetup of the file /goform/formALGSetup of the component Web-based Configuration Interface. This manipulation of the argument wlan-url causes open redirect. The attack is possible to be...

CVE-2025-15256: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web-based Configuration Interface. The manipulation of the argument rootAPmac leads to command injection. Remote exploitation of the attack i...

CVE-2025-15257: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function formRoute of the file /gogorm/formRoute of the component Web-based Configuration Interface. The manipulation of the argument strIp/strMask/strGateway results in command injection. The...

CVE-2019-12103: Improper Neutralization of Special Elements used in an OS Command

The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authentication command injection vulnerability...

PT-2019-12642

Name of the Vulnerable Software and Affected Versions TP-Link M7350 V3 versions prior to firmware 190531 Description The web-based configuration interface is affected by several post-authentication command injection issues. Recommendations For versions prior to firmware 190531, update the firmwar...

PT-2019-4121

Name of the Vulnerable Software and Affected Versions TP-Link M7350 versions prior to firmware 190531 Description The issue is related to the lack of data sanitization at the management level, allowing a remote attacker to execute arbitrary commands before authentication. This can be exploited...

FreePBX 2.10.0, 2.9.0 Multiple Vulnerabilities

Exploit for php platform in category web applications Product: FreePBX Version: 2.10.0, 2.9.0 and perhaps earlier versions Type: Remote Command Execution, XSS Release Date: March 14, 2012 Vendor Notification Date: Jun 12, 2011 Author: Martin Tschirsich Overview: A remote command execution...