314 matches found
CVE-2025-25760
A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...
CVE-2025-25760
A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...
CVE-2025-25760
A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...
CVE-2024-53542
The CVE-2024-53542 entry concerns NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus (v8.x to v8.6). The issue is an incorrect access control in the /iclock/Settings?restartNCS=1 endpoint that allows an attacker to arbitrarily restart the NCServiceManger via a crafted GET request. Public sources...
The vulnerability of the /htdocs/web/getcfg.php file in the D-Link DIR-815 router’s microprogramming software allows a hacker to access confidential information.
The vulnerability of the /htdocs/web/getcfg.php file in the D-Link DIR-815 router microprogramming system is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to disclose confidential information through a specially crafted GET request...
CVE-2024-44893
An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request...
14Finger Security Vulnerability
14Finger is a full-featured Web fingerprint recognition and sharing platform by b1ackc4t individual developers. A security vulnerability exists in 14Finger version 1.1, which stems from the /api/admin/user component that allows an attacker to access all user information via a crafted GET request...
CVE-2024-37767
CVE-2024-37767 affects 14Finger v1.1. The issue is insecure permissions in the component "/api/admin/user", enabling an attacker to access all user information via a crafted GET request. Reported across multiple sources (NVD, Red Hat, OSV, CNNVD, CVEs lists). The underlying problem is improper ac...
CVE-2024-37767
Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request...
CVE-2024-33383
Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter...
CVE-2024-33383
The CVE-2024-33383 case concerns novel-plus versions 4.3.0 and earlier, with an Arbitrary File Read via a crafted GET request that uses the filePath parameter to expose sensitive data. Affected component is the application’s filePath-handling path; root cause is improper validation/handling of fi...
CVE-2023-31889
An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service via crafted GET request...
CVE-2023-31889
CVE-2023-31889 affects ASUS RT-AC51U with firmware versions up to 3.0.0.4.380.8591. The issue is an HTTPD service vulnerability allowing local attackers to cause a denial of service via a crafted GET request. Connected sources confirm the affected product and impact as described; there is no deta...
CVE-2023-31889
An issue discovered in httpd in ASUS RT-AC51U with firmware version up to and including 3.0.0.4.380.8591 allows local attackers to cause a denial of service via crafted GET request...
ASUS RT-AC51U 安全漏洞
The ASUS RT-AC51U is a wireless router from Asus China. A security vulnerability exists in ASUS RT-AC51U 3.0.0.4.380.8591 and earlier versions, which originates from a vulnerability that allows a local attacker to cause a denial of service via a crafted GET request...
CVE-2024-31551
CVE-2024-31551 : A directory traversal in cmseasy v7.7.7.9 20240105 (lib/admin/image.admin.php) allows attackers to delete arbitrary files via a crafted GET request. Affected product: Cmseasy. CVSS v3.1 base score 7.5 (Network, Privileges: None, User interaction: None, Confidentiality: None, Inte...
The vulnerability of the CGI script nas_sharing.cgi of the D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L NAS devices allows a hacker to execute arbitrary code.
The vulnerability of the CGI script nassharing.cgi of the D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L device operating systems is related to the use of pre-installed user accounts. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted...
CVE-2024-28734
Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter...