47281 matches found
CVE-2025-14756 Authenticated Command Injection Vulnerability in Archer MR600
Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console, possibly leading to service disruption or...
EUVD-2025-206350
Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console, possibly leading to service disruption or...
CVE-2026-24432
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 lack cross-site request forgery CSRF protections on administrative endpoints, including those used to change administrator account credentials. As a result, an attacker can craft malicious requests that, when triggered b...
K000159707: NPM vulnerability CVE-2025-59145
Security Advisory Description color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added...
BIT-ARGO-WORKFLOWS-2026-23960 Argo Workflows affected by stored XSS in the artifact directory listing
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 and 3.7.8, stored XSS in the artifact directory listing allows any workflow author to execute arbitrary JavaScript in another user’s browser under the Argo...
Exploit for Cross-site Scripting in Iptanus Wordpress_File_Upload
CVE-2024-6651 POC XSS - CVE-2024-6651 PoC funcional para l...
PT-2026-4796
Name of the Vulnerable Software and Affected Versions TP-Link Archer MR600 version v5 Description A command injection issue exists in the admin interface component. Authenticated attackers can execute system commands with a limited character length through crafted input in the browser developer...
Tenda W30E security vulnerabilities
The Tenda W30E is a router produced by the Chinese company Tenda. The Tenda W30E V2 and earlier versions have security vulnerabilities. These vulnerabilities stem from the lack of appropriate cache control instructions, which may lead to the storage of credentials in the browser’s local storage...
Tucows (VDP): Password Strength Policy Bypass via Server-Side Validation Flaw
A password strength policy bypass was discovered due to a server-side validation flaw. The password strength policy was only enforced in the browser, not on the server side...
CVE-2025-67231
A reflected cross-site scripting XSS vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload...
OESA-2026-1236 avahi security update
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. This enables you to plug your laptop or computer into a network and instantly be able to view other people who you can chat with, find printers to print to or find files being shared...
UBUNTU-CVE-2025-3839
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this...
CVE-2025-3839
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this...
CVE-2025-3839 Epiphany: insecure external protocol invocation in epiphany
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this...
CVE-2025-3839 Epiphany: insecure external protocol invocation in epiphany
A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this...
CVE-2025-3839
CVE-2025-3839 affects Epiphany. A flaw in how Epiphany opens external URL handler applications with minimal user interaction can be abused to execute code on the client via trusted UI behavior. The root cause is insecure invocation of external handlers, enabling potential remote-looking actions w...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Email template field. An attacker can execute arbitrary HTML or script code in the context of the user by injecting malicious content into this field. Details Cross-site scripting or XSS is a code...
CVE-2025-67231
CVE-2025-67231 is a confirmed reflected XSS in ToDesktop Builder v0.33.1. The issue allows an attacker to execute arbitrary code in the context of a user’s browser via a crafted payload. Documented by multiple feeds (NVD, Red Hat, CIRCL, attackerkb, CVE lists) consistently describe a reflected XS...
PT-2026-4498
Name of the Vulnerable Software and Affected Versions ToDesktop Builder version 0.33.1 Description A reflected cross-site scripting XSS issue exists in ToDesktop Builder. This allows attackers to execute arbitrary code within a user's browser through a specially crafted payload. The issue involve...