CVE-2025-27910: Cross-Site Request Forgery (CSRF)

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2024-50707

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-For header in an HTTP GET request...

CVE-2025-1696: Insertion of Sensitive Information into Log File

A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs. In affected versions, proxy configuration data—potentially including sensitive details—was written to log files in clear text whenever an...

CVE-2024-50707

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-For header in an HTTP GET request...

CVE-2024-50707

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-For header in an HTTP GET request...

CVE-2024-50707: Improper Control of Generation of Code

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-For header in an HTTP GET request...

CVE-2024-50707

Uniguest Tripleplay versions prior to 24.2.1 are vulnerable to an unauthenticated remote code execution vulnerability. An attacker can execute arbitrary code by sending an HTTP GET request containing a malicious X-Forwarded-For header . To remediate this issue, it is recommended to update the sof...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-25759

An issue in the component admintemplate.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-25759

An issue in the component admintemplate.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request...

CVE-2025-25760

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-1738: Use of GET Request Method With Sensitive Query Strings

A Password Transmitted over Query String vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity, exposing this sensitive information to a third party...

PT-2025-8944

Name of the Vulnerable Software and Affected Versions SUCMS version 1.0 Description The issue allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request. This is due to a problem in the component admin template.php. Recommendations For SUCMS version 1....

CVE-2025-25760: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the component adminwebgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request...

CVE-2025-25759: Improper Limitation of a Pathname to a Restricted Directory

An issue in the component admintemplate.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request...

CVE-2024-53542

Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to arbitrarily restart the NCServiceManger via a crafted GET request...

CVE-2024-53542

NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus versions v8.x through v8.6 are vulnerable to an incorrect access control flaw in the /iclock/Settings?restartNCS=1 component. An attacker can exploit this by sending a crafted GET request to arbitrarily restart the NCServiceManger . As a mitigat...