D-Link DIR-860LB1和D-Link DIR-868LB1 命令注入漏洞

The D-Link DIR-860LB1 and D-Link DIR-868LB1 are both wireless routers from China-based AUO D-Link. A command injection vulnerability exists in the D-Link DIR-860LB1 and D-Link DIR-868LB1 version 203b01/203b03, which stems from incorrect manipulation of the parameter Hostname in the DHCP Daemon...

EUVD-2025-203230

The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userbackgetjson function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract...

CVE-2025-36748 Stored Cross-Site Scripting (XSS) vulnerability in Growatt ShineLan-X

ShineLan-X contains a stored cross site scripting XSS vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module’s settings center. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization in the /admin/config/site endpoint, which allows an attacker to inject malicious scripts via the datataxonomies parameter and execute them in users’ browsers...

CVE-2025-14540 Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure

The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userbackgetjson function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract...

Arbitrary Code Execution

QOS.CH logback-core is vulnerable to Arbitrary Code Execution. The vulnerability is due to unsafe conditional processing of configuration files and environment variables, which allows an attacker with existing privileges to inject or modify a malicious configuration and execute arbitrary code at...

PT-2025-51098

ShineLan-X contains a stored cross site scripting XSS vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module’s settings center. This may allow attackers to force a legitimate user’s browser’s JavaScript engine to run malicious...

Malicious code in eslint-config-zoo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20693f27e329a7fcc147d2a795f91732a8aca8b142bd27f0ec38803814ae388a The package eslint-config-zoo was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-203037

Malicious code in eslint-config-zoo npm...

Malicious Package

Overview eslint-config-zoo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-192558 Malicious code in eslint-config-zoo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20693f27e329a7fcc147d2a795f91732a8aca8b142bd27f0ec38803814ae388a The package eslint-config-zoo was found to contain malicious code. Source: ghsa-malware...

CVE-2025-56120

OS Command Injection vulnerability in Ruijie X60 PRO X6010212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devconfig/configretain.lua...

CVE-2025-56085

OS Command Injection vulnerability in Ruijie RG-EW1200 EW3.01B11P227EW120011130208RG-EW1200 V1.00 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devconfig/configretain.lua...

CVE-2025-56114

OS Command Injection vulnerability in Ruijie M18 EW3.01B11P226M1810223116 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devconfig/configretain.lua...

UTT 512W 缓冲区错误漏洞

The UTT Progressive 512W is an enterprise-grade wireless router from Atech UTT designed for small and medium-sized businesses SOHO and similarly sized network environments for access scenarios of 30 to 50 users. The UTT Progress 512W suffers from a memory corruption vulnerability that originates...

PT-2025-50967

Name of the Vulnerable Software and Affected Versions UTT 进取 512W versions through 1.7.7-171114 Description A flaw exists in UTT 进取 512W up to version 1.7.7-171114. Manipulation of the hidcontact argument in the '/goform/formWebAuthGlobalConfig' path can lead to memory corruption. Remote...

CVE-2024-58287

The CVE concerns reNgine 2.2.0, where a command-injection flaw exists in the nmap_cmd parameter of the scan engine configuration. The underlying issue allows authenticated attackers to modify the nmap_cmd field with malicious base64-encoded payloads, enabling remote code execution during scan eng...

EUVD-2025-202716

OS Command Injection vulnerability in Ruijie X60 PRO X6010212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devconfig/configretain.lua...

EUVD-2025-202721

OS Command Injection vulnerability in Ruijie M18 EW3.01B11P226M1810223116 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devconfig/configretain.lua...

EUVD-2025-202734

OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226EW1800GX-PRO10223117 allowing attackers to execute arbitrary commands via a crafted POST request to the moduleset in file /usr/local/lua/devconfig/configretain.lua...