453 matches found
CVE-2026-21422
Dell PowerScale OneFS, versions 9.10.0.0 through 9.10.1.5 and versions 9.11.0.0 through 9.12.0.1, contains an external control of system or configuration setting vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to protection mechani...
CVE-2026-28271
Kiteworks Core (PDN) prior to version 9.2.0 contains a SSRF bypass vulnerability in configuration functionality exploitable via DNS rebinding, allowing access to restricted internal services. Patch available in 9.2.0. Exploitation details are not provided in the documents; no explicit in-the-wild...
GFI Archiver 代码问题漏洞
GFI Archiver is an email archiving software developed by GFI Corporation. It is used to protect, store, and retrieve your electronic communications. GFI Archiver has a code vulnerability that stems from a lack of data validation for data provided to users during the configuration of the...
CVE-2026-2535 Comfast CF-N1 V2 mbox-config sub_44AB9C command injection
A vulnerability was found in Comfast CF-N1 V2 2.6.0.2. The impacted element is the function sub44AB9C of the file /cgi-bin/mbox-config?method=SET§ion=ptestchannel. The manipulation of the argument channel results in command injection. The attack can be launched remotely. The exploit has been...
Exploit for Incorrect Authorization in Suse Pam-Config
CVE-2025-6018 + CVE-2025-6019 Exploit Chain This exploit was...
Exploit for Incorrect Authorization in Suse Pam-Config
No d...
CVE-2025-52627
Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0...
CVE-2025-52627
Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0...
CVE-2025-52627
CVE-2025-52627 affects HCL AION (AI lifecycle management platform) 2.0, where the root filesystem is not mounted read-only, allowing unintended modifications to critical system files and potential system compromise. Connected sources corroborate the issue and cite root-file-system write access as...
EUVD-2025-206681
Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potentially increasing the risk of system compromise or unauthorized changes.This issue affects AION: 2.0...
CVE-2026-24994
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through = 3.5.7.2...
Logback allows an attacker to instantiate classes already present on the class path
ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially...
PT-2026-3611
Multiple reflected cross-site scripting xss vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This...
CVE-2025-68658
Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1 has a stored XSS vulnerability exists in the Configuration Information functionality. An authenticated user with the permission “Configuration...
Open Source Point of Sale 跨站脚本漏洞
Open Source Point of Sale is an open source web-based point of sale system from opensourcepos. A cross-site scripting vulnerability exists in Open Source Point of Sale versions 3.4.0 and 3.4.1, which stems from a stored cross-site script in the configuration function that could cause an...
CVE-2021-31926
AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by crafting an HTTPS request directly to the applicable API endpoint despite not having permission to make changes to the system's network...
CVE-2021-22652
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution...
CVE-2017-18803
NETGEAR R7800 devices before 1.0.2.30 are affected by incorrect configuration of security settings...
Ongoing Attacks Exploiting Critical RCE Vulnerability in Legacy D-Link DSL Routers
A newly discovered critical security flaw in legacy D-Link DSL gateway routers has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-0625 CVSS score: 9.3, concerns a case of command injection in the "dnscfg.cgi" endpoint that arises as a result of improper...
Selea Targa IP OCR-ANPR Camera 访问控制错误漏洞
Selea Targa IP OCR-ANPR Camera is an IP camera from Selea. An access control error vulnerability exists in the Selea Targa IP OCR-ANPR Camera that stems from the use of hard-coded passwords, which could lead to unauthorized configuration access...