CVE-2025-57327

spmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc version 1.2.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum...

PT-2025-34611 · D Link · Dsl-7740C

Name of the Vulnerable Software and Affected Versions: D-Link DSL-7740C version DSL7740C.V6.TR069.20211230 Description: An incorrect access control issue exists in the config.xgi function of the device. This allows attackers to download the configuration file by submitting a crafted web request...

CVE-2020-19553

Cross Site Scripting XSS vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.class.php...

CVE-2019-14266

OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...

PT-2026-3089

Name of the Vulnerable Software and Affected Versions GPAC version 2.4.0 Description A heap overflow exists in the uncv parse config function. This issue can be triggered by processing a specially crafted MP4 file, potentially leading to a Denial of Service DoS. Recommendations Update to a newer...

PT-2024-28627 · Bert-Vits · Bert-Vits

Name of the Vulnerable Software and Affected Versions: Bert-VITS2 versions 2.3 and earlier Description: The issue is related to the data dir variable, where user input is concatenated with other folders and used to open a new file in the generate config function, leading to a limited file write...

CVE-2024-38998

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2024-28313

Name of the Vulnerable Software and Affected Versions requirejs version 2.3.6 Description The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties through a prototype pollution vulnerability in the config function. Recommendations Fo...

CVE-2024-34201

TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a stack buffer overflow vulnerability in the getSaveConfig function...

Path Traversal

Whoogle Search is vulnerable to Path Traversal. The vulnerability is caused due to a lack of validation for the name variable in the config function within app/routes.py. This allows an attacker to perform a limited file write, overwriting existing files or creating new ones...

PT-2023-15585 · Totolink · Totolink A7100Ru

Name of the Vulnerable Software and Affected Versions: TOTOlink A7100RU version 7.4cu.2313 B20191024 Description: A command injection issue was discovered via the password parameter in the setting/setOpenVpnCertGenerationCfg function. This allows for potential exploitation. Recommendations: For...

CVE-2022-38850

The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config of llibmpcodecs/vfscale.c...

Input validation

The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config of llibmpcodecs/vfscale.c...

MPlayer numerical error vulnerability

MPlayer is an open source multimedia player from the MPlayer team. A security vulnerability exists in the MPlayer Project mencoder SVN-r38374-13.0.1 version, which stems from an easy-to-zero-divide function config via llibmpcodecs/vfscale.c. The vulnerability is caused by the use of the function...

PT-2022-23789 · Totolink · Totolink A7000R

Name of the Vulnerable Software and Affected Versions: TOTOLink A7000R version 9.1.0u.6115 B20201022 Description: A stack overflow issue was discovered via the ip parameter in the setDiagnosisCfg function. Recommendations: For TOTOLink A7000R version 9.1.0u.6115 B20201022, consider restricting...

CVE-2020-19553

Cross Site Scripting XSS vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.class.php...

CVE-2020-19553

Cross Site Scripting XSS vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.class.php...

CVE-2020-19553: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/libs/class/ckditor.class.php...

PT-2021-10368

Name of the Vulnerable Software and Affected Versions: WUZHI CMS versions up to and including 4.1.0 Description: A Cross Site Scripting XSS issue exists in the config function in coreframe/app/attachment/libs/class/ckditor.class.php. This allows for potential malicious script execution...

Directory traversal

Directory traversal vulnerability in the saveconfig function in ntpd in ntpcontrol.c in NTP before 4.2.8p4, when used on systems that do not use '' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files...