CVE-2025-15225 Sunnet｜WMPro - Arbitrary File Read

WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files...

SUNNET WMPro 代码问题漏洞

SUNNET WMPro is a suite of online learning platforms from Taiwan, China-based Sunnet Technology SUNNET. SUNNET WMPro suffers from a code issue vulnerability that stems from the presence of an arbitrary file upload vulnerability that could allow an unauthenticated, remote attacker to upload and...

PT-2025-53703

Name of the Vulnerable Software and Affected Versions BPMFlowWebkit affected versions not specified Description BPMFlowWebkit developed by WELLTEND TECHNOLOGY has an issue that allows unauthenticated remote attackers to download arbitrary system files by exploiting Absolute Path Traversal. The...

CVE-2024-42718

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter...

CVE-2025-66737

Yealink T21PE2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request result read function of the diagnostic component...

CVE-2025-65885

Delight Custom Firmware (CFW) for Nokia Symbian Belle devices (Nokia 808, N8, E7, C7, 700, 701, 603, 500, E6, Oro, Vertu Constellation T) is affected by a local vulnerability where crafted .txt files placed in the :\Data directory can inject startup scripts. Root cause and details indicate a loca...

The vulnerability of IBM OpenPages, a risk management platform for enterprises, relates to the disclosure of system data by unauthorized parties in the controlled area. This allows attackers to expose protected information.

The vulnerability of IBM OpenPages, a risk management platform for enterprises, involves the disclosure of system data that is not accessible to authorized personnel in the controlled area. Exploiting this vulnerability could allow an attacker, operating remotely, to disclose protected informatio...

ROS-20251226-7302

A vulnerability in the Twisted network framework is related to the failure to take measures to protect the structure of a web page. Exploitation of the vulnerability allows a remote attacker to gain access to sensitive data and compromise its integrity...

SUSE CVE-2025-12816

An interpretation-conflict CWE-436 vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions...

Kentico Xperience cross-site scripting vulnerability (CNVD-2026-05123)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary web script or HTML by injecting a crafted payload...

Kentico Xperience Information Disclosure Vulnerability (CNVD-2026-04247)

Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience suffers from an information disclosure vulnerability that can be exploited by attackers to cause information disclosure...

CVE-2018-25146

Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes. Attackers can send arbitrary signals to kill background processes and system services through a hidden feature, potentially causing service...

CVE-2018-25146

Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes. Attackers can send arbitrary signals to kill background processes and system services through a hidden feature, potentially causing service...

CVE-2018-25141

FLIR thermal traffic cameras contain an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly retrieve video streams by accessing specific endpoints like /live.mjpeg, /snapshot.jpg, and RTSP streaming URLs without...

CVE-2018-25139

FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly connect to the RTSP stream using tools like VLC or FFmpeg to view and record thermal camera footage...

CVE-2018-25139

FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly connect to the RTSP stream using tools like VLC or FFmpeg to view and record thermal camera footage...

CVE-2018-25146 Microhard Systems IPn4G 1.1.0 Service Control Denial of Service

Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes. Attackers can send arbitrary signals to kill background processes and system services through a hidden feature, potentially causing service...

CVE-2018-25145

The CVE concerns Microhard Systems IPn4G 1.1.0, where an authenticated user can download sensitive configuration files via a configuration-disclosure vulnerability. Affected component is the device’s configuration storage accessible from multiple directories including '/www', '/etc/m_cli/', and '...

CVE-2018-25139 FLIR AX8 Thermal Camera 1.32.16 Unauthenticated RTSP Stream Disclosure

FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly connect to the RTSP stream using tools like VLC or FFmpeg to view and record thermal camera footage...

CVE-2018-25130 Beward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted Database

Beward Intercom 2.3.1 contains a credentials disclosure vulnerability that allows local attackers to access plain-text authentication credentials stored in an unencrypted database file. Attackers can read the BEWARD.INTERCOM.FDB file to extract usernames and passwords, enabling unauthorized acces...