CVE-2025-43928

In Infodraw Media Relay Service MRS 7.1.0.0, the MRS web server on port 12654 allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing...

PT-2025-17400 · Infodraw · Infodraw Media Relay Service

Name of the Vulnerable Software and Affected Versions: Infodraw Media Relay Service version 7.1.0.0 Description: The issue allows reading arbitrary files via ../ directory traversal in the username field. This can potentially reveal administrator credentials in cleartext or with MD5 hashing when...

CVE-2025-43928

The CVE-2025-43928 entry concerns Infodraw Media Relay Service (MRS) v7.1.0.0. The MRS web server (port 12654) exposes a path traversal in the username field, enabling reading arbitrary files. Reading ServerParameters.xml could disclose administrator credentials (cleartext or MD5 hashed). Affecte...

CVE-2025-28235

An information disclosure vulnerability in the component /socket.io/1/websocket/ of Soundcraft Ui Series Models Ui12 and Ui16 Firmware v1.0.7x and v1.0.5x allows attackers to access Administrator credentials in plaintext...

CVE-2025-28230

Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials...

CVE-2025-28230

Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials...

PT-2025-17324 · Soundcraft · Soundcraft Ui Series

Name of the Vulnerable Software and Affected Versions: Soundcraft Ui Series Models Ui12 and Ui16 Firmware versions 1.0.5x through 1.0.7x Description: An information disclosure issue in the /socket.io/1/websocket/ component allows attackers to access Administrator credentials in plaintext...

CVE-2025-28230

CVE-2025-28230 affects JMBroadcast JMB0150 Firmware v1.0. Root cause: incorrect access control that allows access to hardcoded administrator credentials. Impact: potential disclosure of hardcoded admin credentials via network access with no user interaction. CVSS v3.1 score: 9.1 (CRITICAL) — AV:N...

Soundcraft Ui Series 安全漏洞

Soundcraft Ui Series is a professional audio mixer from Soundcraft. A security vulnerability exists in the Soundcraft Ui Series Models Ui12 and Ui16 Firmware versions 1.0.7x and 1.0.5x, which originates in the /socket.io/1/websocket/ component that could lead to the disclosure of administrator...

CVE-2025-28230

Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials...

PT-2025-17300 · Unknown · Jmbroadcast Jmb0150 Firmware

Name of the Vulnerable Software and Affected Versions: JMBroadcast JMB0150 Firmware version 1.0 Description: The issue is related to incorrect access control, allowing attackers to access hardcoded administrator credentials. Recommendations: For JMBroadcast JMB0150 Firmware version 1.0, consider...

CVE-2025-28235

An information disclosure vulnerability in the component /socket.io/1/websocket/ of Soundcraft Ui Series Models Ui12 and Ui16 Firmware v1.0.7x and v1.0.5x allows attackers to access Administrator credentials in plaintext...

The vulnerability of the E-Staff automated recruitment process system, related to errors in data filtering during file recording, allows a perpetrator to execute arbitrary commands.

The vulnerability of the E-Staff recruitment process automation system is related to errors in data filtering during the writing of information into files. Exploiting this vulnerability can allow a malicious actor to reset the administrator’s credentials and execute arbitrary commands...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-xxe-inj-696OZTCm)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request...

The vulnerability of the authentication system for microprogrammed Ethernet switch FortiSwitch lies in the lack of necessary checks when changing passwords via the graphical user interface. This allows attackers to escalate their privileges.

The vulnerability of the authentication system for Microprogrammed Ethernet switches of FortiSwitch lies in the lack of necessary checks during password changes in the graphical user interface. Exploiting this vulnerability allows a malicious actor to enhance their privileges by altering the...

CVE-2025-20203

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against users of the interface of an affected system. The...

OpenEMR 安全漏洞

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. A security vulnerability exists in OpenEMR versions prior to 7.0.3, which stems...

kanidm-provision 日志信息泄露漏洞

kanidm-provision is a small utility program from the individual developers at oddlama to help configure kanidm. A log information disclosure vulnerability exists in kanidm-provision versions prior to 1.2.0, which stems from a function error in the supplied kanidm patch that causes administrator...

CVE-2024-50630

Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to obtain administrator credentials via unspecified vectors...

CVE-2024-50630

Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to obtain administrator credentials via unspecified vectors...