111927 matches found
CVE-2025-65427
CVE-2025-65427: Problema di Limitazione della Velocità di Autenticazione in Dbit N300 T1 Pro ID CVE: CVE-2025-65427 Data: 2025-12-16 Scopritore: Kirubel Prodotto: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router Versione Firmware: V1.0.0 Descrizione È stato scoperto un problema nel Dbit N300 T1...
CVE-2025-63820
CVE-2025-63820 Einreicher: Nicola Giuffrida Informationen Hersteller: TOTOLINK Website des Herstellers: TOTOLINK Modell: A720R Firmware-Version: V4.1.5cu.630B20250509 Firmware-Downloadadresse: TOTOLINK Details zur Schwachstelle Beim Anmelden am Kontrollpanel werden Benutzername und Passwort im...
CVE-2025-63420
CVE-2025-63420 CrushFTP11 precedente alla versione 11.3.757 è vulnerabile a un'iniezione HTML persistente nel Pannello di Amministrazione di CrushFTP Report / "Who Created Folder", consentendo l'esecuzione persistente di HTML nelle sessioni admin. CWE CWE-79 — Neutralizzazione Impropria dell'Inpu...
CVE-2024-10924
CVE-2024-10924 - Bypass dell'autenticazione in Really Simple Security PANORAMICA Questo progetto dimostra lo sfruttamento e la mitigazione di CVE-2024-10924, una vulnerabilità critica di bypass dell'autenticazione nel plugin WordPress "Really Simple Security". STEP 1: CONFIGURAZIONE DELL'AMBIENTE...
Western Digital MyCloud NAS - Authentication Bypass
It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...
Apache APISIX - Remote Code Execution
A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...
PT-2026-107411
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...
CVE-2026-102161 Security Advisory 0190
An unauthenticated attacker located on an adjacent private network or any attacker routed through a reverse proxy/load balancer that forwards client headers can forge their source IP address and gain administrative session privileges on the CV-CUE backend...
CVE-2026-106513
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...
CVE-2026-106513
The MISP platform contains a vulnerability where users with site-admin privileges can reconfigure Redis host addresses for the core application, ZeroMQ plugin, and SimpleBackgroundJobs plugin via the web UI or API. Because background job workers trust raw Redis payloads without validation, an att...
EUVD-2026-93669
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...
CVE-2026-106513 MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...
CVE-2026-106513 MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...
CVE-2026-106513 MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJobs plugin—through its web UI and API to site-admin users. The background job workers trust raw Redis job payloads without additional...
CVE-2026-101207
Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,...
CVE-2026-18322
CVE-2026-18322 — Smart Popup von Supsystic Privilegienausweitung Sicherheitsforschung zu CVE-2026-18322 , einer nicht authentifizierten Privilegienausweitungs- Schwachstelle im WordPress-Plugin Smart Popup by Supsystic popup-by-supsystic. Dieses Repository enthält eine Ursachenanalyse, die aus de...
EUVD-2026-93575
Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,...
CVE-2026-101207
Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,...
CVE-2026-101207
Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,...
CVE-2026-44848-PoC
CVE-2026-44848 — Portainer: Fehlende Autorisierung an Docker-Plugin-Endpunkten → Host-RCE Proof-of-concept für CVE-2026-44848 , eine Schwachstelle mit fehlender Authentifizierung CWE-862 in Portainer, die es einem Nicht-Admin -Benutzer mit Docker-Endpunktzugriff ermöglicht, privilegierte...