CVE-2025-44868

Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the pingtest function of the adm.cgi via the pingIp parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44848

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44837

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or magicid parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44836

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44846

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44865

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2024-13688

The Admin and Site Enhancements ASE WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass the protection offered via a crafted request...

The vulnerability of the eval() function in Cloud Deployment modules and the Query Tool, a database management tool for pgAdmin 4, allows a hacker to execute arbitrary code.

The vulnerability of the eval function in the Cloud Deployment and Query Tool modules of the pgAdmin 4 database management tool is related to improper code generation during processing of endpoints like /sqleditor/querytool/download and /cloud/deploy, when the querycommited and highavailability...

The vulnerability of the favicon.ico component of the SafeInspect system for controlling privileged users allows a violator to disclose protected information.

The vulnerability of the favicon.ico component in the SafeInspect privilege management system is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose protected information through a specially crafted GET...

CVE-2023-44752

An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscdms/admin/login.php...

VulnCheck KEV: CVE-2025-42599

Qualitia Active! Mail contains a stack-based buffer overflow vulnerability that allows a remote, unauthenticated attacker to execute arbitrary or trigger a denial-of-service via a specially crafted request...

SUSE CVE-2025-32906

A flaw was found in libsoup, where the soupheadersparserequest function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server...

CVE-2025-28101

CVE-2025-28101 affects flaskBlog v2.6.1, where the /post/{postTitle} endpoint allows arbitrary file deletion by crafting a POST request, enabling deletion of article titles created by other users. Documented details confirm the vulnerable component and impact (I/A low, C=none) with CVSSv3.1 score...

CVE-2024-53303

A remote code execution RCE vulnerability in the uploadfile function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated attackers to execute arbitrary code via a crafted POST request...

Security Bulletin: IBM Storage Ceph is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in Grafana (CVE-2023-1387)

Summary Grafana is used by IBM Storage Ceph in the dashboard. CVE-2023-1387 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID:CVE-2023-1387 DESCRIPTION: Grafana could allow a remote authenticated attacker to obtain sensitive informatio...

CVE-2025-32906

A flaw was found in libsoup, where the soupheadersparserequest function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server...

AZL-60433 CVE-2025-32906 affecting package libsoup for versions less than 3.4.4-4

A flaw was found in libsoup, where the soupheadersparserequest function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server...

AC23 Denial of Service Vulnerability in Shenzhen Jixiang Tengda Technology Co.

The AC23 is a wireless router that provides high-speed wireless network connectivity. A denial of service vulnerability exists in the AC23 of Shenzhen Jixiang Tengda Technology Co. The vulnerability stems from improper handling of the getuid parameter by the /goform/VerAPIMant component. An...

The vulnerability of the authentication system for microprogrammed Ethernet switch FortiSwitch lies in the lack of necessary checks when changing passwords via the graphical user interface. This allows attackers to escalate their privileges.

The vulnerability of the authentication system for Microprogrammed Ethernet switches of FortiSwitch lies in the lack of necessary checks during password changes in the graphical user interface. Exploiting this vulnerability allows a malicious actor to enhance their privileges by altering the...