CVE-2025-5416

CVE-2025-5416 concerns Keycloak exposing sensitive environment information via the authenticated-accessible endpoint /admin/serverinfo . Multiple sources describe an information-disclosure flaw that can reveal internal server details when an authenticated user accesses the endpoint. The NVD and R...

CVE-2024-56361

LGSL Live Game Server List provides online status for games. Before 7.0.0, a stored cross-site scripting XSS vulnerability was identified in lgsl. The function lgslquery40 in lgslprotocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS by sending a crafted payload to the /info endpoint via the lgslquery40 function. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an...

PT-2024-36803 · Lgsl · Lgsl

Name of the Vulnerable Software and Affected Versions: LGSL versions prior to 7.0.0 Description: A stored cross-site scripting XSS vulnerability was identified in LGSL. The issue arises from improper sanitation of user input. The function lgsl query 40 in lgsl protocol.php has implemented an HTTP...

PT-2024-34374 · Unknown · Python Food Ordering System

Name of the Vulnerable Software and Affected Versions: python food ordering system version V1.0 Description: The python food ordering system has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through the...

Pomerium exposed OAuth2 access and ID tokens in user info endpoint response

Impact The Pomerium user info page at /.pomerium unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be more severe in the presence of an XSS vulnerability in an upstream...

CVE-2024-39315 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page at /.pomerium unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be...

PT-2024-28365 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component /admin/info deal.php?mudi=del&dataType=news&dataTypeCN. This issue allows for unauthorized requests to be made. The mudi, dataType, and...

Linksys E5600 Command Injection Vulnerability

Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys USA. A command injection vulnerability exists in the Linksys E5600 v1.1.0.26, which stems from the failure of the PinCode parameter of the /API/info form endpoint to properly filter constructed command special characters...

PT-2024-14347 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: The issue is related to a stack overflow that can occur via the iptv.stb.mode parameter in the setIptvInfo function. Recommendations: For Tenda AX1803 version 1.0.0.1, as a temporary workaround,...

PT-2024-18994

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev77 Description Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRET KEY variable. This issue allows attackers to access sensitive information, which could ha...

VulnCheck KEV: CVE-2018-11409

Splunk through 7.0.1 allows information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key...

PT-2023-22784 · Archery · Archery

Name of the Vulnerable Software and Affected Versions: Archery affected versions not specified Description: The Archery project contains multiple SQL injection vulnerabilities that may allow an attacker to query connected databases. User input from the db name and tb name parameter values in the...

PT-2022-27197 · Tenda · Tenda I21

Name of the Vulnerable Software and Affected Versions: Tenda i21 version 1.0.0.144656 Description: The issue is related to a Buffer Overflow that can be triggered via the "/goform/setDiagnoseInfo" API endpoint. Recommendations: For Tenda i21 version 1.0.0.144656, consider restricting access to th...

PT-2022-27211 · Unknown · Purchase Order Management System

Name of the Vulnerable Software and Affected Versions: Purchase Order Management System version 1.0 Description: The issue concerns a file upload vulnerability. It can be exploited via the /purchase order/admin/?page=system info API endpoint. Recommendations: For Purchase Order Management System...

The vulnerability of the /cloud_config/router_post/upgrade_info function in TP-LINK’s WR-886N router software allows a attacker to execute arbitrary code.

The vulnerability of the /cloudconfig/routerpost/upgradeinfo function in TP-LINK’s WR-886N router software arises due to a buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely by using a specially crafted request...

EXCELLENT INFOTEK CORPORATION (EIC) E-document System 信息泄露漏洞

Excellent Infotek Corporation EIC e-document system is an application system of Excellent Infotek Corporation. It provides precise, simple and standardized XML document forms to simplify the process of writing and transmitting complicated documents. EXCELLENT INFOTEK CORPORATION EIC E-document...

Splunk Information Disclosure Vulnerability

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index and analyze machine-generated data, including data generated by all IT systems and infrastructures physical, virtual and cloud. A security...

ForgeRock OpenIDM info endpoint information disclosure vulnerability

ForgeRock OpenIDM is a suite of scalable identity management tools for managing the identity lifecycle and provisioning issues from ForgeRock, Inc. info endpoint is one of the info endpoints. A security vulnerability exists in the info endpoint in ForgeRock OpenIDM. An attacker could exploit this...

CVE-2017-7589

In OpenIDM through 4.0.0 before 4.5.0, the info endpoint may leak sensitive information upon a request by the "anonymous" user, as demonstrated by responses with a 200 HTTP status code and a JSON object containing IP address strings. This is related to a missing access-control check in...