CVE-2025-67070

The CVE-2025-67070 entry concerns Intelbras CFTV IP NVD 9032 R Ftd, v2.800.00IB00C.0.T, where an unauthenticated attacker can bypass MFA during password recovery, enabling the attacker to change the admin password and gain full access to the admin panel. Affected components/versions are consisten...

CVE-2025-67070

A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the multi-factor authentication MFA mechanism during the password recovery process. This results in the ability to change the admin password and gain full access to th...

CVE-2019-16639

An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker who only has web interface access to use TELNET commands and/or show admin passwords via the modeurl=exec= substring. This affects EG-2000SE EGRGOS 11.9...

CVE-2019-16674

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL10M 3.3.16 Build 16102416 devices. Authentication Information used in a cookie is predictable and can lead to admin password compromise when captured on the network...

CVE-2026-21411

Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authentication and change the password...

CVE-2026-21411

Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authentication and change the password...

CVE-2026-21411

CVE-2026-21411 affects Plat’Home OpenBlocks series (OpenBlocks IoT VX2) prior to FW5.0.8. Root cause: authentication bypass vulnerability allowing a user to bypass administrator authentication and change passwords. Impact is high (unauthenticated access to change credentials; confidentiality, int...

Plat’Home OpenBlocks IoT VX2 安全漏洞

Plat'home Plat'Home OpenBlocks IoT VX2 is an IoT gateway device from Plat'home Japan. A security vulnerability exists in the Plat'Home OpenBlocks IoT VX2 that stems from an authentication bypass that could allow an attacker to bypass administrator authentication and change the password...

EUVD-2025-206083

Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NOLISTEXEPATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration,...

CVE-2020-36904

Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NOLISTEXEPATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration,...

CVE-2020-36904 Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint

Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NOLISTEXEPATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration,...

PT-2025-54418

Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NO LIST EXE PATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration,...

VulnCheck KEV: CVE-2025-10204

A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display and use the form. This form allows you to chang...

CVE-2023-54327

Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls...

CVE-2023-54327

Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls...

CVE-2023-54327

CVE-2023-54327 affects Tinycontrol LAN Controller 1.58a. An authentication bypass allows unauthenticated attackers to change admin passwords by sending a crafted request to the /stm.cgi endpoint, disabling access controls and modifying administrative credentials. Impacts are described as high (co...

CVE-2023-54327 Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change

Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls...

CVE-2023-54327 Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change

Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls...

PT-2025-53595

Name of the Vulnerable Software and Affected Versions Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem version 2.5.1 Description A flaw in access control within the Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem firmware allows attackers to modify the Administrator passwor...

CVE-2025-67015

CVE-2025-67015 affects the Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1. Root cause is improper access control that lets an unauthenticated attacker modify the Administrator password and escalate privileges by sending a crafted POST to /Forms/admin_access_1. Im...