CVE-2025-24482

Rockwell Automation FactoryTalk View Site Edition has a Local Code Injection vulnerability due to incorrect default permissions on the remote debugger port, affecting all versions prior to 15.0. Affected functionality includes DLLs being executed with elevated privileges, potentially enabling una...

CVE-2025-24482 FactoryTalk® View Site Edition - Local Code Injection

A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for DLLs to be executed with higher level permissions...

CVE-2025-24482 FactoryTalk® View Site Edition - Local Code Injection

A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for DLLs to be executed with higher level permissions...

CVE-2025-24479 FactoryTalk® View Machine Edition - Local Code Injection

A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access to the Command Prompt as a higher privileged user...

CVE-2025-24479 FactoryTalk® View Machine Edition - Local Code Injection

A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access to the Command Prompt as a higher privileged user...

EsafeNet CDG 代码注入漏洞

EsafeNet CDG is a document security management system from EsafeNet. A code injection vulnerability exists in EsafeNet CDG version V5, which originates from the parameter help in the file /SysConfig.jsp that can lead to cross-site scripting...

PT-2025-5371 · Rockwell Automation · Factorytalk® View Site Edition

Name of the Vulnerable Software and Affected Versions: Product and version affected versions not specified Description: A Local Code Injection issue exists due to incorrect default permissions, allowing for the execution of DLLs with higher-level permissions. Recommendations: At the moment, there...

CVE-2024-57514

The CVE-2024-57514 entry concerns the TP-Link Archer A20 v3 router. Affected component is the web interface’s directory listing handling, where improper processing of listing paths enables Cross-site Scripting (XSS) when a crafted URL is visited. This allows injection of arbitrary JavaScript that...

CVE-2025-24814

Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that 1 use the "FileSystemConfigSetService" component the default in "standalone" or "user-managed" mode, and 2 are running without authentication and authorization are vulnerable to a sort...

Apache Hadoop Code Injection Vulnerability

Apache Ambari is an application from the Apache USA Foundation. Provides software developed to configure, manage and monitor Apache Hadoop clusters to simplify Hadoop management. A code injection vulnerability exists in Apache Hadoop. The vulnerability is due to a vulnerability in the Ambari...

IBM Jazz Foundation Cross-Site Scripting Vulnerability (CNVD-2025-02830)

IBM Jazz Foundation is a next-generation collaboration platform for software delivery technology from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Jazz Foundation. An attacker could exploit the vulnerability to embed arbitrary JavaScript code in the Web ...

dcat-admin 代码注入漏洞

dcat-admin is a Laravel-based back-end system builder by Jiang Qinghua, an individual developer. A code injection vulnerability exists in dcat-admin version 2.2.1-beta, which originates from the component Roles Page's file /admin/auth/roles that can lead to cross-site scripting...

bootplus 代码注入漏洞

bootplus is a privilege management framework by JoeyBling Personal Developer. A code injection vulnerability exists in bootplus, which originates from the file /admin/sys/admin.html that can lead to cross-site scripting...

CampCodes School Management Software 代码注入漏洞

CampCodes School Management Software is a school management software from CampCodes, Inc. A code injection vulnerability exists in version 1.0 of CampCodes School Management Software, which stems from the parameter Notice in the file /notice-list and can lead to cross-site scripting...

opencms 代码注入漏洞

opencms is a CMS system by fumiao individual developer. A code injection vulnerability exists in opencms version 2.2, which originates from the parameter model in the file /admin/model/addOrUpdate that can lead to cross-site scripting...

Sprecher Automation SPRECON-E-C/P/T3 Improper Input Validation (CVE-2022-4332)

In Sprecher Automation SPRECON-E-C/P/T3 CPU in variant PU244x a vulnerable firmware verification has been identified. Through physical access and hardware manipulation, an attacker might be able to bypass hardware-based code verification and thus inject and execute arbitrary code and gain full...

WordPress plugin GamiPress 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...

WordPress plugin GamiPress 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

CVE-2024-51941

A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code. The vulnerability occurs when processing alert definitions, where malicious input can be injected into the alert script execution path. An...

CVE-2025-23196

A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. The vulnerability arises when defining alert scripts, where the script filename field is executed using sh -c. An attacker with authenticated...