CVE-2025-56162

YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates user input into orderRaw'fieldgoodsid, ...', allowing attackers to: a enumerate or modify database data, including dumping admin password...

CVE-2025-34210

The CVE concerns Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SAAS deployments). The connected sources confirm that sensitive credentials (database passwords, MySQL root password, SaaS keys, Portainer admin password, etc.) are stored in cleartext files that are ...

Use Of Default Credentials

github.com/neuvector/neuvector is vulnerable to Use of Default Credentials. The vulnerability is due to hardcoded default password due to the use of a fixed string as the default admin password, which can be exploited if not changed immediately after deployment, allowing attackers with network...

CVE-2025-56241

Aztech DSL5005EN firmware 1.00.AZ2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator password via a crafted POST request to sysAccess.asp. This allows full administrative control of the router without authentication...

CVE-2025-56241

Aztech DSL5005EN firmware 1.00.AZ2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator password via a crafted POST request to sysAccess.asp. This allows full administrative control of the router without authentication...

Aztech DSL5005EN 安全漏洞

The Aztech DSL5005EN is a wireless router from Aztech. A security vulnerability exists in the Aztech DSL5005EN version 1.00.AZ2013-05-10, which originates from an unauthenticated attacker being able to change the administrator password via a specially crafted POST request, which could result in...

PT-2025-39314

Name of the Vulnerable Software and Affected Versions Aztech DSL5005EN firmware version 1.00.AZ 2013-05-10 and other versions affected versions not specified Description An unauthenticated attacker can modify the administrator password by sending a specially crafted POST request to the...

CVE-2025-57433

The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By sending a crafted POST request to a specific endpoint /cwi/ajaxrequest/getdata.php, an authenticated attacker even with a low-privileged account like guest can retrieve the hashed passwords for the...

CVE-2025-8077

A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in admin account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default...

PT-2025-38476

Name of the Vulnerable Software and Affected Versions H3C devices versions NX15V100R015 Description H3C devices are susceptible to unauthorized access due to insecure default credentials. The root user account lacks a password, and the H3C user account utilizes the default password “admin”, both...

CVE-2025-8077 NeuVector admin account has insecure default password

A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in admin account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default...

CVE-2025-8077

CVE-2025-8077 describes a vulnerability in NeuVector up to version 5.4.5 where the built-in admin account uses a fixed string as the default password. If this password is not changed after deployment, any workload with network access within the cluster could use the default credentials to obtain ...

NeuVector 安全漏洞

NeuVector is an end-to-end container security platform from US-based NeuVector. The platform includes features such as image vulnerability management, access control and container process/filesystem protection. A security vulnerability exists in NeuVector versions 5.4.5 and earlier, which stems...

CVE-2025-10204

A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display and use the form. This form allows you to chang...

CVE-2025-10204

AC Smart II contains an authentication bypass vulnerability (CVE-2025-10204) due to a hidden admin password-reset form that can be manipulated via browser developer tools to display and use the form. The form allows changing the administrator password without verifying login status or permissions...

LG Electronics AC Smart II 安全漏洞

LG Electronics AC Smart II is a centralized centralized controller for air conditioners from LG Electronics, a South Korean company. A security vulnerability exists in the LG Electronics AC Smart II that stems from a hidden form that allows unauthorized changes to the administrator's password,...

CVE-2025-58761 Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The realpmsimageproxy endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. The realpmsimageproxy i...

CVE-2025-58760 Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The /image API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. In Tautulli, the /image API...

CVE-2025-58760

CVE-2025-58760 affects Tautulli up to version 2.15.3. The vulnerability is a path traversal in the unauthenticated /image endpoint, which serves static images from the app data directory and can be exploited to read arbitrary files on the server. Impacted files include tautulli.db (JWT tokens) an...

CVE-2025-57766 Fides's Admin UI User Password Change Does Not Invalidate Current Session

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors such as XSS ca...