CVE-2025-45466

Unitree Go1 = Go120220511 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext...

CVE-2025-7742

An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the devices non-volatile storage. This action may result in remote code execution that allows an attacker to run arbitrary commands on the target...

CVE-2025-6385

The WP Applink plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-5529 Educenter <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Educenter theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Circle Counter Block in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-7722

The Social Streams plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their user meta information in the updateusermeta function. This makes it possible for...

CVE-2025-7742

An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the devices non-volatile storage. This action may result in remote code execution that allows an attacker to run arbitrary commands on the target...

CVE-2024-48730

The default configuration in ETSI Open-Source MANO OSM v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authentication attempts performed by the default admin user, allowing a remote attacker to escalate privileges...

LG Innotek LNV5110R 安全漏洞

LG Innotek LNV5110R is a webcam from LG Innotek, a South Korean company. A security vulnerability exists in the LG Innotek LNV5110R that stems from an authentication vulnerability that could lead to remote code execution...

CVE-2025-30135

An issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without Authentication can occur. It lacks authentication controls on its HTTP and RTSP interfaces, allowing attackers to retrieve sensitive files and video recordings. By connecting to...

CVE-2025-7742 Authentication Bypass in LG Innotek Camera

An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the devices non-volatile storage. This action may result in remote code execution that allows an attacker to run arbitrary commands on the target...

CVE-2025-7742 Authentication Bypass in LG Innotek Camera

An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the devices non-volatile storage. This action may result in remote code execution that allows an attacker to run arbitrary commands on the target...

CVE-2025-7742

CVE-2025-7742 affects the LG Innotek camera model LNV5110R. Affected firmware exposes an authentication vulnerability that lets an attacker upload to the device’s non-volatile storage via HTTP POST, enabling remote code execution with administrator privileges. In public sources, the vulnerability...

CVE-2025-6260 Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset us...

CVE-2025-7695

CVE-2025-7695 – Dataverse Integration (WordPress) : The Dataverse Integration plugin versions 2.77–2.81 are vulnerable to privilege escalation via the reset_password_link REST endpoint. The handler accepts a client-supplied id, email, or login and calls get_password_reset_key() after only validat...

CVE-2025-6539 Voltax Video Player <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The Voltax Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

Fortinet FortiWeb Fabric Connector SQL Injection

Fortinet FortiWeb 7.0.x 7.0.11, 7.2.x 7.2.11, 7.4.x 7.4.8, 7.6.x 7.6.4 is vulnerable to a pre-authentication SQL injection that can lead to remote code execution. By leveraging this vulnerability, a remote and unauthenticated attacker can inject malicious SQL queries into the FortiWeb Fabric...

PT-2025-30693 · Lg Innotek · Lnv5110R

Name of the Vulnerable Software and Affected Versions: LG Innotek camera model LNV5110R Description: An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the device’s non-volatile storage. This acti...

Devolutions Server <= 2025.1.11.0 / 2025.2.2.0 < 2025.2.4.0 Weak Credentials (DEVO-2025-0012) (CVE-2025-6523)

The version of Devolutions Server installed on the remote host is prior to 2025.1.11.0 or 2025.2.2.0 prior to 2025.2.4.0 and is, therefore, affected by a weak credentials vulnerability: - Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated...

CVE-2025-36117

CVE-2025-36117 affects IBM Db2 Mirror for i 7.4–7.6. The vulnerability arises because the system does not discard the session id after use, enabling an authenticated user to impersonate another user on the system. Impact is described as session fixation with potential for credential/identity misu...

CVE-2025-41100

Incorrect authentication vulnerability in ParkingDoor. Through this vulnerability it is possible to operate the device without the access being logged in the application and even if the access permissions have been revoked...