CVE-2025-34310: Improper Neutralization of Input During Web Page Generation

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the INCSPD, OUTSPD, DEFCLASSINC, and DEFCLASSOUT parameters when updating Quality of Service QoS settings. When a...

CVE-2025-34317: Improper Neutralization of Input During Web Page Generation

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the TLSHOSTNAME parameter when adding a new DNS entry. When a user adds a DNS entry, the application issues an HT...

CVE-2025-34306: Improper Neutralization of Input During Web Page Generation

IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the default firewall IP search values. When a user updates these defaults,...

TOTOLINK A3300R cgi-bin/cstecgi.cgi setLanguageCfg DoS

The vulnerability of the setLanguageCfg function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A3300R router’s microprogramming system is related to the output of operations that go beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service...

CVE-2025-53701

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS Cross-site Scripting attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users. The vendor did not respond in any way. Only version 1.1.0.1...

CVE-2025-53702

Vilar VS-IPC1002 IP cameras are vulnerable to DoS Denial-of-Service attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive. A manual restart of the device is required. The vendor did not...

CVE-2025-53702

Vilar VS-IPC1002 IP cameras are vulnerable to DoS Denial-of-Service attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive. A manual restart of the device is required. The vendor did not...

CVE-2025-53701

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS Cross-site Scripting attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users. The vendor did not respond in any way. Only version 1.1.0.1...

EUVD-2025-35685

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS Cross-site Scripting attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users. The vendor did not respond in any way. Only version 1.1.0.1...

CVE-2025-53701 XSS vulnerability in Vilar VS-IPC1002 IP cameras

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS Cross-site Scripting attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users. The vendor did not respond in any way. Only version 1.1.0.1...

CVE-2025-53701 XSS vulnerability in Vilar VS-IPC1002 IP cameras

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS Cross-site Scripting attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users. The vendor did not respond in any way. Only version 1.1.0.1...

EUVD-2025-35686

Vilar VS-IPC1002 IP cameras are vulnerable to DoS Denial-of-Service attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive. A manual restart of the device is required. The vendor did not...

CVE-2025-53702 DoS vulnerability in Vilar VS-IPC1002 IP cameras

Vilar VS-IPC1002 IP cameras are vulnerable to DoS Denial-of-Service attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive. A manual restart of the device is required. The vendor did not...

PT-2025-43512

Name of the Vulnerable Software and Affected Versions Vilar VS-IPC1002 IP cameras affected versions not specified Description Vilar VS-IPC1002 IP cameras are susceptible to Reflected Cross-Site Scripting XSS attacks. This occurs because parameters within GET requests sent to the /cgi-bin/action A...

Vilar VS-IPC1002 跨站脚本漏洞

Vilar VS-IPC1002 is a webcam from the Chinese company Vilar. A cross-site scripting vulnerability exists in the Vilar VS-IPC1002 version 1.1.0.18, which stems from improper cleanup of the GET request parameter on the /cgi-bin/action endpoint, which could lead to a reflected cross-site scripting...

PT-2025-43513

Name of the Vulnerable Software and Affected Versions Vilar VS-IPC1002 IP cameras affected versions not specified Description Vilar VS-IPC1002 IP cameras are susceptible to Denial-of-Service DoS attacks. An unauthenticated attacker on the same local network can send a crafted request to the...

CVE-2025-53701: Improper Neutralization of Input During Web Page Generation

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS Cross-site Scripting attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized properly, making it possible to target logged in admin users. The vendor did not respond in any way. Only version 1.1.0.1...

Vilar VS-IPC1002 安全漏洞

The Vilar VS-IPC1002 is a webcam from the Chinese company Vilar. A security vulnerability exists in the Vilar VS-IPC1002 version 1.1.0.18, which originates from an unauthenticated attacker who can send a specially crafted request to the /cgi-bin/action endpoint, potentially resulting in a denial ...

CVE-2025-53702: Improper Handling of Exceptional Conditions

Vilar VS-IPC1002 IP cameras are vulnerable to DoS Denial-of-Service attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive. A manual restart of the device is required. The vendor did not...

Wavlink /cgi-bin/adm.cgi Arbitrary Command Execution

The vulnerability of the /cgi-bin/adm.cgi file of the Wavlink WL-WN579A3 router’s microprogramming system is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...