PT-2025-53854

Name of the Vulnerable Software and Affected Versions Apache StreamPipes versions 0.69.0 through 0.97.0 Description A flaw exists in Apache StreamPipes that allows a user with a non-administrator account to manipulate the user ID creation mechanism. This manipulation enables the swapping of a...

PT-2025-53847

Name of the Vulnerable Software and Affected Versions Advance WP Query Search Filter WordPress plugin versions through 1.0.10 Description The software does not properly sanitize and escape a parameter before displaying it, potentially leading to a Reflected Cross-Site Scripting issue. This could ...

JM-DATA ONU JF511-TV 安全漏洞

The JM-DATA ONU JF511-TV is an optical cat terminal device from JM-DATA Austria. A security vulnerability exists in the JM-DATA ONU JF511-TV version 1.0.67, which stems from the use of default credentials and could lead to unauthorized administrator access...

PT-2025-53800

Name of the Vulnerable Software and Affected Versions Micro Registration Utility µURU versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893 Description The Micro Registration Utility µURU, a telephone self registration utility based on asterisk, contains a flaw due to...

CVE-2025-67015

Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/adminaccess1...

CVE-2025-67349

CVE-2025-67349 : FluentCMS 1.2.3 is affected by a cross-site scripting (XSS) vulnerability in the Add Page workflow. After admin login, input entered in the head section is not properly sanitized, allowing an attacker to inject arbitrary script tags. Descriptions across multiple sources confirm t...

EUVD-2025-205446

Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/adminaccess1...

EUVD-2025-205445

Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an administrative endpoint...

CVE-2025-67015

Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/adminaccess1...

Kentico Xperience Cross-Site Scripting Vulnerability (CNVD-2026-05120)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute malicious script in an administrator user's browser...

CVE-2019-25242

FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by...

CVE-2019-25242 FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface

FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by...

CVE-2018-25149

CVE-2018-25149 affects Microhard Systems IPn4G 1.1.0. The vulnerability is a cross-site request forgery (CSRF) in the device’s web interface that allows an attacker to induce administrative actions without user consent by tricking an authenticated user into loading a malicious page. Documented im...

CVE-2018-25127 SOCA Access Control System 180612 Cross-Site Request Forgery via Admin Interface

SOCA Access Control System 180612 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages that submit forged requests to create admin accounts by tricking logged-in users...

Cross-Site Scripting (XSS)

ezsystems/ezplatform-admin-ui is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of user-controlled input in image asset names, content language names, and future publishing features, which allows an attacker with back-office editor or administrator privilege...

WordPress Gift Hunt plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LIM MINHYOEK in WordPress Plugin Gift Hunt versions = 2.0.2...

RLSA-2025:23279 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns CVE-2025-38499 kernel: net: tun: Update napi-skb after XDP process CVE-2025-39984 For more details about the...

EUVD-2025-204965

MSP360 Free Backup Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSP360 Free Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

PT-2025-53370

Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a hidden form to add a superuser account by tricking a logged-in administrator...

Teradek Cube 安全漏洞

Teradek Cube is a video decoder from Teradek. A security vulnerability exists in Teradek Cube version 7.3.6, which stems from vulnerability to a cross-site request forgery attack that could result in a change of the administrator password...