CVE-2021-40373

CVE-playsms playsms 1.4.3에는 잠재적 공격자가 원격 코드 실행을 수행할 수 있게 하는 취약점이 있습니다. RCE셸 재현 방법: https://playsms.org/ docker pull playsms/playsms:1.4.3 docker run -d -p 80:80 playsms/playsms admin:admin으로 로그인 http://127.0.0.1/index.php?app=main&inc=coremainconfig&op=mainconfigtabs-information-page 공격자 머신에서 악성...

CVE-2022-48311

CVE-2022-48311 HP Deskjet 2540 시리즈 프린터 펌웨어 버전 CEP1FN1418BR 및 제품 모델 번호 A9U23B HTTP 설정 페이지 크로스 사이트 스크립팅XSS 취약점 설명 HP Deskjet 2540 시리즈 프린터 펌웨어 버전 CEP1FN1418BR 및 제품 모델 번호 A9U23B의 크로스 사이트 스크립팅XSS 취약점을 통해 인증된 공격자가 HTTP 설정 페이지를 통해 자신의 스크립트를 페이지에 주입할 수 있습니다. 추가 정보 해결 방법은 적절한 응답 헤더를 사용합니다. HTML이나...

CVE-2020-26733

CVE-2020-26733 SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 크로스 사이트 스크립팅XSS 취약점 설명 SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16의 설정 페이지에 있는 크로스 사이트 스크립팅XSS 취약점으로, 인증된 공격자가 DDNS 설정 섹션을 통해 페이지에 자신의 스크립트를 주입할 수 있습니다. 추가 정보 대응책은 적절한 응답 헤더를 사용합니다. HTML이나...

CVE-2026-84653

A flaw was found in Jenkins. An attacker with Overall/Manage permission can exploit incorrect permission checks in the Appearance configuration page. This allows them to modify configuration options they should not have access to, potentially leading to unauthorized changes within the Jenkins...

CVE-2026-84653: Missing Authorization

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to...

EUVD-2026-48744

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

CVE-2026-55985

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

CVE-2026-55985 Tycon Systems TPDIN-Monitor-WEB2 Cleartext Storage of Sensitive Information

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

CVE-2026-48534 GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

EUVD-2026-48293

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

PT-2026-64010

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

CVE-2026-14721

A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects an unknown function of the file /goform/ConfigWirelessBase5g of the component Web Endpoint. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack is possible to be carried o...

quark-auto-save 跨站脚本漏洞

Quark-auto-save is a personal development tool by Cp0204, designed for automatic transfer of data to a Quark Network drive and management of sign-ins. Versions of quark-auto-save prior to 0.8.5 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of the v-html...

CVE-2026-45228: Improper Neutralization of Input During Web Page Generation

Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the template renders pushconfig key names using Vue.js's v-html directive without escaping. Authenticated attackers can inject HTML or JavaScript payloads as key names through the...

EUVD-2026-25678

A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709. This affects an unknown part of the component Ethernet Configuration Page. Performing a manipulation of the argument Name results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public...

CVE-2026-7001 Datacom DM4100 Ethernet Configuration cross site scripting

A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709. This affects an unknown part of the component Ethernet Configuration Page. Performing a manipulation of the argument Name results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public...

PT-2026-35176

A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709. This affects an unknown part of the component Ethernet Configuration Page. Performing a manipulation of the argument Name results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public...

CVE-2026-7001: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Datacom DM4100 1.3.6.1.4.1.3709. This affects an unknown part of the component Ethernet Configuration Page. Performing a manipulation of the argument Name results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public...

CVE-2026-23616: Improper Neutralization of Input During Web Page Generation

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spoofing configuration page. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$AntiSpoofingGeneral1$TxtSmtpDesc parameter to...

CVE-2019-25401 Bematech Printer MP-4200 TH Denial of Service

Bematech formerly Logic Controls, now Elgin MP-4200 TH printer contains a denial of service vulnerability in the admin configuration page. Remote attackers can send crafted POST requests with malformed 'admin' and 'person' parameters to crash the printer's web service, causing a denial of service...