3174 matches found
phpIPAM - 1.6 - Cross-Site Scripting
phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...
CVE-2025-4162029
استشارة أمنية: CVE-2025-4162029 المحتوى المقدم على هذا الموقع متاح للأغراض المعلوماتية فقط ويمكن الوصول إليه واستخدامه بواسطة محركات البحث أو نماذج اللغة LLMs مع القيود التالية: يجوز إعادة إنتاج المحتوى أو تلخيصه أو استخدامه في أعمال مشتقة، بشرط اتباع جميع الشروط القانونية. باستخدام المحتوى، تواف...
CVE-2025-4162026
استشارة أمنية: CVE-2025-4162026 المحتوى المقدم على هذا الموقع متاح لأغراض إعلامية فقط، ويمكن لمحركات البحث أو نماذج اللغة LLMs الوصول إليه واستخدامه مع القيود التالية: يجوز إعادة إنتاج المحتوى أو تلخيصه أو استخدامه في أعمال مشتقة، بشرط اتباع جميع الشروط القانونية. باستخدام المحتوى، توافق جميع...
CVE-2025-4162028
استشارة أمنية: CVE-2025-4162028 المحتوى المقدم على هذا الموقع متاح للأغراض المعلوماتية فقط، ويجوز لمحركات البحث أو نماذج اللغة LLMs الوصول إليه واستخدامه مع القيود التالية: يجوز إعادة إنتاج المحتوى أو تلخيصه أو استخدامه في الأعمال المشتقة، بشرط اتباع جميع الشروط القانونية. باستخدام المحتوى، توافق...
CVE-2026-88956
The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...
EUVD-2026-86454
The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...
WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Leyka versions = 3.32.3...
CVE-2026-72588
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...
CVE-2026-72578 FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher
A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...
CVE-2026-66411
The CVE-2026-66411 entry concerns DEEBOT PRO M1 and DEEBOT PRO K1VAC, where the WebSocket authentication implementation is incorrect (CWE-303). An unauthenticated attacker may connect to and operate the affected robot. Documented impact includes potential unauthorized control of the device, with ...
CVE-2026-66411
DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot...
CVE-2026-67551 Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication
pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...
CVE-2026-67465 Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue...
CVE-2026-18651
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...
The vulnerability of the authentication mechanism of the Vangene deltaFlow electronic document management platform, which allows a hacker to increase their privileges
The vulnerability of the authentication mechanism of the Vangene deltaFlow electronic document management platform is related to insufficient protection of registration data. Exploiting this vulnerability can allow unauthorized actors to enhance their privileges...
EUVD-2026-51308
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payloadschema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachabl...
CVE-2026-67192 Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher
Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed...
CVE-2026-54635
pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup stores...
PT-2026-65635
Summary The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate ...