870 matches found
CVE-2025-71166
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting XSS vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in...
CVE-2025-71165 Typesetter CMS Reflected XSS via Status.php
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting XSS vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php...
CVE-2021-31925
Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via the administrative web interface...
CVE-2026-22082: Session Fixation
This vulnerability exists in Tenda wireless routers 300Mbps Wireless Router F3 and N300 Easy Setup Router due to the use of login credentials as the session ID through its web-based administrative interface. A remote attacker could exploit this vulnerability by intercepting network traffic and...
CVE-2018-25156
CVE-2018-25156 affects Teradek Cube 7.3.6. The vulnerability is a cross-site request forgery that lets an attacker change the device administrator password by luring a user to submit a hidden CSRF-form crafted request to the device’s system configuration interface. Impact is change of admin passw...
EUVD-2025-204738
An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initial startup of the container sets a property of "allowany" to allow any user with a valid and trusted client auth...
CVE-2025-14777
A flaw was found in Keycloak. An IDOR Broken Access Control vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer client ID provided in the A...
CVE-2025-34330 AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated Prompt File Upload via ajaxPromptUploadFile.php
AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component F2MAdmin that exposes an unauthenticated prompt upload endpoint at AudioCodesfiles/utils/IVR/diagram/ajaxPromptUploadFile.php. The script accepts an uploaded file and...
The vulnerability of the “User Management” module of the Nagios XI monitoring tool’s administrative interface allows a attacker to perform cross-site scripting (XSS) attacks.
The vulnerability of the “User Management” module of the Nagios XI monitoring tool’s administrative interface is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...
CVE-2025-60503: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated...
CVE-2023-53690 Nagios Fusion < 4.2.0 LDAP/AD Integration Stored XSS
Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting XSS vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views th...
EUVD-1999-0865
Malware in sbrugna...
EUVD-2012-2941
Malware in sbrugna...
EUVD-2010-0144
Malware in sbrugna...
EUVD-2019-10407
Malware in sbrugna...
EUVD-2000-0975
Malware in sbrugna...
EUVD-2005-4652
Malware in sbrugna...
EUVD-2005-3102
Malware in sbrugna...