EUVD-2025-36548

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...

CVE-2025-60800

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...

CVE-2025-60800

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...

CVE-2025-60800

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...

PT-2025-44195

Name of the Vulnerable Software and Affected Versions jshERP versions prior to commit 90c411a Description An access control issue exists in the /jshERP-boot/user/info interface of jshERP. An attacker can obtain sensitive information by sending a specially crafted GET request to this interface. Th...

CVE-2025-60800

The jshERP (Huaxia ERP) system is vulnerable to an improper access control flaw in the /jshERP-boot/user/info interface in versions up to commit 90c411a . Attackers can exploit this by sending a crafted GET request to obtain sensitive information from the API endpoint. To remediate this vulnerabi...

CVE-2025-60800

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...

CVE-2025-60800: Improper Access Control

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request...

Exploit for Improper Input Validation in Atlassian Confluence_Data_Center

LetsDefend-SOC235-Atlassian-Confluence-Broken-Access-Control-0...

The vulnerability in the web interface of D-Link DSL-7740C microprogramming device’s router management interface allows a hacker to execute arbitrary commands.

The vulnerability in the web interface for managing D-Link DSL-7740C microprogramming routers is related to insufficient validation of input data during the processing of the EXE parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending a specially...

EUVD-2025-34263

A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-60535

A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-60535

A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-41706

The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...

CVE-2025-41706

CVE-2025-41706 affects the Phoenix Contact webserver used in the QUINT4-UPS/24DC/24DC/10/EIP family. The issue is a denial-of-service condition that an unauthenticated remote attacker can trigger by sending a specially crafted GET request with an over-long Content-Length header. The vulnerability...

EUVD-2025-34148

The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...

CVE-2025-60535

A Cross-Site Request Forgery (CSRF) vulnerability exists in Wallos v4.1.1 , specifically within the /endpoints/currency/currency component. This flaw allows an attacker to execute arbitrary operations by sending a crafted GET request . While the vulnerability is confirmed across multiple sources,...

CVE-2025-60535: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-60535

A Cross-Site Request Forgery CSRF in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request...

CVE-2025-41706: Buffer Copy without Checking Size of Input

The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality...