11582 matches found
CVE-2025-34068
An unauthenticated remote command execution vulnerability exists in Samsung WLAN AP WEA453e firmware prior to version 5.2.4.T1 via improper input validation in the “Tech Support” diagnostic functionality. The command1 and command2 POST or GET parameters accept arbitrary shell commands that are...
CVE-2025-20288
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery SSRF attack through an affected device. This vulnerability is due to improper input validation for specific HTTP...
WordPress plugin WP Delicious 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress WP Delicious, which stems from improper input neutralization, and can be exploited by attackers to tamper with web...
WordPress plugin Tennis Court Bookings 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
WordPress plugin JetTricks 跨站脚本漏洞
WordPress JetTricks is a plugin developed for WordPress to enhance the Elementor page builder. WordPress JetTricks suffers from a cross-site scripting vulnerability that stems from improper input neutralization, which can be exploited by an attacker to trigger the execution of malicious scripts b...
WordPress plugin JetElements For Elementor 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress plugin Bold Page Builder 跨站脚本漏洞
WordPress Bold Page Builder is a free and open source page builder plugin that allows users to quickly create custom page layouts through a drag and drop interface without writing code. WordPress Bold Page Builder suffers from a cross-site scripting vulnerability that originates from improper inp...
PT-2025-29857 · Cisco · Cisco Unified Intelligence Center
Name of the Vulnerable Software and Affected Versions: Cisco Unified Intelligence Center affected versions not specified Description: A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a server-side request forgery SSRF attack. This...
CVE-2025-34103
An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due to improper input handling in the undocumented /cgi-bin/rdfs.cgi endpoint. The Client parameter is not sanitized before being passed to a system call, allowing an unauthenticat...
Atlassian Jira Service Management Data Center and Server 5.12.x < 5.12.23 / 10.2.x < 10.3.6 / 10.4.x < 10.6.1 (JSDSERVER-16260)
The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16260 advisory. - Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid...
Ivanti Endpoint Manager Mobile OS Command Injection Vulnerability
Ivanti Endpoint Manager Mobile is an enterprise-grade mobile device management MDM solution designed to provide comprehensive mobile device lifecycle management capabilities for organizations. Ivanti Endpoint Manager Mobile suffers from an OS command injection vulnerability that stems from...
Apache Tomcat 9.0.76 < 9.0.104 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 9.0.104. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.104security-9 advisory. - Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid...
CVE-2025-53471
Emerson ValveLink products contain an input validation flaw where received data is not properly validated, potentially causing unsafe or incorrect data processing. The CVE notes a local, high-complexity impact with no privileges required (CVSS 3.1/5.1 and CVSS 4.0/5.9). The Red Hat/NVD/CVE lineag...
CVE-2025-53471 Emerson ValveLink Products Improper Input Validation
Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly...
CVE-2025-24005
A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation...
PT-2025-29140 · Riverbed · Riverbed Steelhead Vcx
Name of the Vulnerable Software and Affected Versions: Riverbed SteelHead VCX versions 9.6.0a Description: A path traversal vulnerability exists due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this...
Improper Input Validation
transformers is vulnerable to improper input validation. The vulnerability is due to insecure URL validation using the startswith method in imageutils.py, which allows an attacker to exploit URL username injection to craft deceptive URLs that appear to originate from trusted sources like YouTube,...
CVE-2025-27367
CVE-2025-27367 affects IBM OpenPages with Watson versions 8.3 through 9.0. The issue is described as improper input validation where an authenticated user can bypass client-side validation for GRC Object fields and craft a payload that allows data to be saved without required fields being stored....
CVE-2025-27367 IBM OpenPages with Watson improper input validation
IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for GRC Objects when an authenticated user sends a specially crafted payload to the server allowing for data to be saved withou...