CVE-2025-6103 Wifi-soft UniBox Controller test_accesscodelogin.php os command injection

A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functionality of the file /billing/testaccesscodelogin.php. The manipulation of the argument Password leads to os command injection. The attack m...

CVE-2025-6102 Wifi-soft UniBox Controller logout.php os command injection

A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument macaddress leads to os command injection. The attack can be launched...

Wifisoft UniBox Controller 安全漏洞

Wifisoft UniBox Controller is a small smart access controller from Wifisoft Corporation, USA. A security vulnerability exists in Wifisoft UniBox Controller 20250506 and prior versions, which stems from an os command injection issue that could lead to the execution of arbitrary commands...

CVE-2025-6103: Improper Neutralization of Special Elements used in an OS Command

A vulnerability, which was classified as critical, has been found in Wifi-soft UniBox Controller up to 20250506. Affected by this issue is some unknown functionality of the file /billing/testaccesscodelogin.php. The manipulation of the argument Password leads to os command injection. The attack m...

CVE-2025-6104: Improper Neutralization of Special Elements used in an OS Command

A vulnerability, which was classified as critical, was found in Wifi-soft UniBox Controller up to 20250506. This affects an unknown part of the file /billing/pmscheck.php. The manipulation of the argument ipaddress leads to os command injection. It is possible to initiate the attack remotely. The...

Wifisoft UniBox Controller 命令注入漏洞

Wifisoft UniBox Controller is a small smart access controller from Wifisoft Corporation, USA. A command injection vulnerability exists in Wifisoft UniBox Controller 20250506 and prior versions, which stems from an os command injection issue that could lead to the execution of arbitrary commands...

PT-2025-25513 · Wifi Soft · Wifi-Soft Unibox Controller

Name of the Vulnerable Software and Affected Versions: Wifi-soft UniBox Controller versions up to 20250506 Description: A critical vulnerability was found in the Wifi-soft UniBox Controller, affecting an unknown functionality of the file /authentication/logout.php. The manipulation of the mac...

CVE-2025-6102: Improper Neutralization of Special Elements used in an OS Command

A vulnerability classified as critical was found in Wifi-soft UniBox Controller up to 20250506. Affected by this vulnerability is an unknown functionality of the file /authentication/logout.php. The manipulation of the argument macaddress leads to os command injection. The attack can be launched...

PT-2025-25515 · Wifi Soft · Wifi-Soft Unibox Controller

Name of the Vulnerable Software and Affected Versions: Wifi-soft UniBox Controller versions up to 20250506 Description: A critical issue was found in Wifi-soft UniBox Controller, affecting an unknown part of the file /billing/pms check.php. The manipulation of the ipaddress argument leads to os...

CVE-2025-5990

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

CVE-2025-5990 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

CVE-2025-5990

The CVE-2025-5990 entry concerns Crafty Controller. A stored XSS vulnerability arises from improper neutralization of input in the Server Name form and API Key form components, enabling a remote, authenticated attacker to inject malicious input. Technical details from PT-2025-25503 specify affect...

CVE-2025-5990 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

CVE-2025-5990 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

Exploit for OS Command Injection in Wago Compact_Controller_100_Firmware

CVE-2023-1698 CVE-2023-1698 exploit with golang how t...

PT-2025-25503 · Unknown · Crafty Controller

Name of the Vulnerable Software and Affected Versions: Crafty Controller versions 4.2.2 through 4.2.3 Crafty Controller versions 4.3.0 through 4.3.2 Crafty Controller versions 4.4.0 through 4.4.9 Description: An input neutralization vulnerability in the Server Name form and API Key form component...

CVE-2025-5990: Improper Neutralization of Input During Web Page Generation

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

Crafty Controller 跨站脚本漏洞

Crafty Controller is a Minecraft server control panel/launcher for Arcadia. A cross-site scripting vulnerability exists in Crafty Controller that stems from improperly neutralized inputs to the server name form and API key form components, which could lead to a stored cross-site scripting attack...

GHSA-62JJ-GR2R-5C34 vulnerabilities

Vulnerabilities for packages: azure-service-operator-fips, elvish, terraform-provider-random-fips, oras-fips, litestream, git-sync, whereabouts, stern, vault-k8s, openbao-k8s-fips, envoy-gateway, secrets-store-csi-driver, kaf, yunikorn-k8shim-fips, aws-network-policy-agent-fips, controller-gen,...

CVE-2024-35295

A vulnerability has been identified in Perfect Harmony GH180 All versions = V8.0 V8.3.3 with NXGPro+ controller manufactured between April 2020 to April 2025. The maintenance connection of affected devices fails to protect access to the device's control unit configuration. This could allow an...