CVE-2025-64054

Fanvil x210 devices running version 2.12.20 are affected by CVE-2025-64054, a reflected XSS vulnerability that can be triggered by a crafted POST to /cgi-bin/webconfig?page=upload&action=submit. The issue can lead to denial of service and potentially arbitrary command execution. Public or vendor-...

PT-2025-49254

A reflected Cross Site Scripting XSS vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint...

CVE-2025-64052

The CVE-2025-64052 entry affects Fanvil x210 V2 firmware 2.12.20. An issue permits unauthenticated attackers on the local network to execute arbitrary system commands. The available documents do not detail the root cause or specific exploitation steps. Public references suggest updating to a newe...

CVE-2025-64052

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands...

CVE-2025-64052

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands...

EUVD-2025-201267

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server...

CVE-2025-55948

This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control RBAC through dual dependency on frontend menu systems and backend permission tables, without enforcing atomic synchronization between these components. The critical flaw manifests...

CVE-2025-55948

This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control RBAC through dual dependency on frontend menu systems and backend permission tables, without enforcing atomic synchronization between these components. The critical flaw manifests...

EUVD-2025-201280

DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host...

CVE-2025-66237 Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials

DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host...

Malicious code in elf-stats-northbound-sparkler-410 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f08736c2162a48e541984d90b3b871f1be3f37ce290cb43fce03b7af871d6804 The package elf-stats-northbound-sparkler-410 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in elf-stats-snowdusted-cookiejar-250 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2480ce9c2a166238de101bac9cb648e0ba2a3b60bb4c0adef110d95d1a701797 The package elf-stats-snowdusted-cookiejar-250 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192370 Malicious code in elf-stats-snowdusted-cookiejar-250 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2480ce9c2a166238de101bac9cb648e0ba2a3b60bb4c0adef110d95d1a701797 The package elf-stats-snowdusted-cookiejar-250 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192369 Malicious code in elf-stats-caroling-wishlist-626 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ff553f8337da6d0bc56a29ed6adb190407c29586610823cb3336ed18c35aa2e The package elf-stats-caroling-wishlist-626 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in elf-stats-caroling-wishlist-626 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ff553f8337da6d0bc56a29ed6adb190407c29586610823cb3336ed18c35aa2e The package elf-stats-caroling-wishlist-626 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192303 Malicious code in elf-stats-ginger-wreath-646 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0736ed9611847ba4c5416cd0bd8ba33bae114769eec8947e7d58c85c3ce100c1 The package elf-stats-ginger-wreath-646 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in elf-stats-ginger-wreath-646 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0736ed9611847ba4c5416cd0bd8ba33bae114769eec8947e7d58c85c3ce100c1 The package elf-stats-ginger-wreath-646 was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-65842

The Aquarius HelperTool 1.0.003 privileged XPC service on macOS contains multiple flaws that allow local privilege escalation. The service accepts XPC connections from any local process without validating the client's identity, and its authorization logic incorrectly calls AuthorizationCopyRights...

CVE-2025-57199

AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the NetFailDetectD binary. This vulnerability allows attackers to execute arbitrary commands via a crafted input...

CVE-2025-57198

AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability in the Machine.cgi endpoint. This vulnerability allows attackers to execute arbitrary commands via a crafted input...