CVE-2025-10953

A security vulnerability has been detected in UTT 1200GW and 1250GW up to 3.0.0-170831/3.2.2-200710. This vulnerability affects unknown code of the file /goform/formApMail. The manipulation of the argument senderEmail leads to buffer overflow. The attack may be initiated remotely. The exploit has...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to HTTP parameter pollution [CVE-2025-7783]

Summary Node.js module form-data is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands are vulnerable to HTTP parameter pollution. This bulletin provides patch information to address the reported vulnerability in Node.js module form-dat...

MAL-2025-47537 Malicious code in @sev-ui-verse/form-validators (npm)

The package @sev-ui-verse/form-validators was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e39d6023f97017127467f853ed7318cce2e7944403638addb101c98a68f52590 Any computer that has this package installed or running should be consider...

Malicious Package

Overview @sev-ui-verse/form-validators is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @sev-ui-verse/form-validators (npm)

The package @sev-ui-verse/form-validators was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e39d6023f97017127467f853ed7318cce2e7944403638addb101c98a68f52590 Any computer that has this package installed or running should be consider...

CVE-2025-9494

An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the /cgi-bin/vitogate.cgi endpoint is affected, when the form JSON parameter is set to form-0-2. The vulnerability stems fro...

D-Link DIR-513 Buffer Overflow Vulnerability (CNVD-2025-23468)

D-Link DIR-513 is a wireless router product from China's AUO D-Link. The D-Link DIR-513 suffers from a buffer overflow vulnerability due to incorrect manipulation of the parameter webpage in the file /goform/formWPS, no details of the vulnerability are provided at this time...

CVE-2025-58665

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tmontg1 Form Generator for WordPress form-generator-powered-by-jotform allows Stored XSS.This issue affects Form Generator for WordPress: from n/a through = 1.52...

Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to form-data-4.0.3.tgz CVE-2025-7783

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to form-data-4.0.3.tgz CVE-2025-7783. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-7783 DESCRIPTION: Use of Insufficiently Random Values vulnerability in...

CVE-2025-57204

Stocky POS with Inventory Management & HRM ui-lib version 5.0 is affected by a Stored Cross-Site Scripting XSS vulnerability within the Products module available to authenticated users. The vulnerability resides in the product name parameter submitted to the product-creation endpoint via a standa...

Security Bulletin: IBM Watsonx BI is affected by use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).

Summary Watsonx BI use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution HPP. This vulnerability is associated with program files lib/formdata.Js. Vulnerability Details CVEID:CVE-2025-7783 DESCRIPTION: Use of Insufficiently Random Values vulnerability in...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2025.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 24.0.0-IF006, 24.0.1-IF004 and 25.0.0-IF001. Vulnerability Details CVEID:CVE-2025-7783 DESCRIPTION: Use of Insufficiently Random...

CVE-2025-57639

OS Command injection vulnerability in Tenda AC9 1.0 was discovered to contain a command injection vulnerability via the usb.samba.guest.user parameter in the formSetSambaConf function of the httpd file...

CVE-2025-9494

An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the /cgi-bin/vitogate.cgi endpoint is affected, when the form JSON parameter is set to form-0-2. The vulnerability stems fro...

CVE-2025-9494 Viessmann Vitogate 300 OS Command Injection

An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the /cgi-bin/vitogate.cgi endpoint is affected, when the form JSON parameter is set to form-0-2. The vulnerability stems fro...

CVE-2025-9494

Vitogate 300 OS command injection (CVE-2025-9494) affects the /cgi-bin/vitogate.cgi endpoint when the JSON form parameter is set to form-0-2. The issue arises from improper sanitization before interpolating input into a format string used by popen(), enabling an authenticated attacker to inject a...

CVE-2025-9494 Viessmann Vitogate 300 OS Command Injection

An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the /cgi-bin/vitogate.cgi endpoint is affected, when the form JSON parameter is set to form-0-2. The vulnerability stems fro...

PT-2025-39103

Name of the Vulnerable Software and Affected Versions Vitogate 300 affected versions not specified Description An OS command injection issue exists in the Vitogate 300. A malicious user can exploit this to compromise affected installations. The issue is present in the /cgi-bin/vitogate.cgi API...

PT-2025-40812

Name of the Vulnerable Software and Affected Versions Belkin F9K1015 version 1.00.10 Description A buffer overflow issue exists in the file /goform/formPPTPSetup. Manipulation of the pptpUserName argument can trigger this issue, allowing for remote exploitation. The exploit has been publicly...

PT-2025-40808

Name of the Vulnerable Software and Affected Versions Belkin F9K1015 version 1.00.10 Description A flaw exists in Belkin F9K1015 version 1.00.10 that allows for command injection. This occurs through manipulation of the wan ipaddr argument within an unknown function of the...