SUSE CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization...

TOTOLINK X2000R 安全漏洞

The X2000R is a wireless router from China's Gion Electronics TOTOLINK. Ltd. X2000R version 1.0.0-B20230726.1108 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the parameter URL Address, which can be exploite...

llisoft MTA Maita Training System 代码问题漏洞

The llisoft MTA Maita Training System is a training system from China Dongke llisoft. A code issue exists in version 4.5 of the llisoft MTA Maita Training System, which is caused by a parameter url operation that results in unlimited uploads...

Tmall_demo 代码注入漏洞

Tmalldemo is a Spring Boot-based mini Tmall by the projectteam. A code injection vulnerability exists in Tmalldemo 20250505 and earlier versions, which stems from cross-site scripting due to incorrect operation of the parameter Detailed Address in the component Buy Item Page...

CVE-2024-46236

CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting XSS via the address parameter in addmembers.php and editmember.php...

CVE-2024-30624

Tenda FH1205 v2.0.0.7775 has a stack overflow vulnerability in the urls parameter from saveParentControlInfo function...

CVE-2024-5375

A vulnerability has been found in Kashipara College Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file submitstudent.php. The manipulation of the argument address leads to cross site scripting. The attack can be launched...

CVE-2024-9952

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=systeminfo/contactinfo of the component Contact Information Page. The manipulation of the argument Address leads to cross site...

CVE-2024-51186

D-Link DIR-820L 1.05b03 was discovered to contain a remote code execution RCE vulnerability via the pingaddr parameter in the pingv4 and pingv6 functions...

CVE-2024-56998

PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting XSS in /edit-profile.php via the parameter $address...

CVE-2023-1046

A vulnerability classified as critical has been found in MuYuCMS 2.2. This affects an unknown part of the file /admin.php/update/getFile.html. The manipulation of the argument url leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed ...

CVE-2023-24729

Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function...

CVE-2022-34580

Advanced School Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the address parameter at ip/school/index.php...

CVE-2018-19137

DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter...

CVE-2014-2850

The network interface configuration page netinterface in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter...

PLANET FW-WGS-804HPT 安全漏洞

Planet FW-WGS-804HPT is a wall mounted managed switch from China PLANET. The Planet FW-WGS-804HPT suffers from a buffer overflow vulnerability that originates from the hostip parameter in the websnmpnotifyv3addpost function failing to correctly validate the length of the input data, which can be...

74cms 安全漏洞

74cms is an online recruitment system based on PHP and MySQL by 74cms. A security vulnerability exists in 74cms 3.33.0 and earlier versions, which stems from improper manipulation of the parameter url in the file /index.php/index/download/index, which could lead to path traversal attacks...

CVE-2025-44863

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

TOTOLINK CA300-PoE 安全漏洞

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE suffers from a command injection vulnerability that stems from the msgprocess function Url parameter failing to correctly filter constructive command special characters, commands, etc., which...

TOTOLINK CA600-PoE 安全漏洞

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the msgprocess function Url parameter failing to properly filter construct command special characters, commands, etc. No...