The vulnerability of the Directum RX ECM system, related to insufficient validation of incoming requests, allows a hacker to perform an SSRF attack.

The vulnerability of the Directum RX ECM system is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack by sending a specially crafted POST request...

Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime 安全漏洞

Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime is a smart wired WiFi video doorbell from Reolink USA. A security vulnerability exists in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime version 3.0.0.46622503122283, which stems from insufficient privilege validation and could...

CVE-2025-9060: Improper Input Validation

A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality that is only available to MFlash administrators. The vulnerability is related to insufficient validation of...

CVE-2025-0309 Netskope Client Local Elevation of Privileges

An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to...

PT-2025-33117

Name of the Vulnerable Software and Affected Versions Netskope Client for Windows affected versions not specified Description An insufficient validation exists in the server connection endpoint of Netskope Client for Windows. This flaw allows local users to elevate their privileges on the system...

The vulnerability of the EPS Server module of the Tableau Server analytical platform allows a attacker to perform an SSRF attack.

The vulnerability of the EPS Server module of the Tableau Server analytical platform is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

The vulnerabilities of the “Add Webhook” and “Test Webhook” functions of the Webhook Feature component of the Versa Director software platform allow attackers to execute arbitrary commands, increase their privileges, or run arbitrary code.

The vulnerability of the “Add Webhook” and “Test Webhook” functions of the Webhook Feature component in the software platform for managing network infrastructure, Versa Director, is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious acto...

The vulnerability of the software system for managing enterprise assets in IBM Maximo Asset Management lies in the insufficient checking of incoming requests, which allows a hacker to execute an SSRF attack.

The vulnerability of the IBM Maximo Asset Management software system-related program management system is related to insufficient checking of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

The vulnerability of the Azure OpenAI cloud platform, related to insufficient validation of incoming requests, allows a hacker to escalate their privileges.

The vulnerability of the Azure OpenAI cloud platform is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

KLA86580 SB vulnerability in 7-Zip

Insufficient validation vulnerability was found in 7-Zip. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories CVE-2025-55188 Exploitation Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is...

CVE-2013-10067

Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface gwadmin.php allows users with administrator privileges to upload files to the gwtemp/a/ directory. Due to insufficient...

Arbitrary File Write

assemblyline-service-client is vulnerable to Arbitrary File Write. The vulnerability is due to insufficient validation of file paths, allowing attackers to write files outside the intended directory...

CVE-2025-53394

Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup file and a renamed executable placed in the same directory. When a user with administrative privileges opens the crafted backup file and...

CVE-2025-50233

A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter in the backend template editor. By manipulating the parameter, attackers can perform directory traversal and access sensitive files outsi...

CVE-2013-10067

Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface gwadmin.php allows users with administrator privileges to upload files to the gwtemp/a/ directory. Due to insufficient...

CVE-2013-10067 Glossword 1.8.8 - 1.8.12 Arbitrary File Upload RCE

Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface gwadmin.php allows users with administrator privileges to upload files to the gwtemp/a/ directory. Due to insufficient...

CVE-2013-10067 Glossword 1.8.8 - 1.8.12 Arbitrary File Upload RCE

Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface gwadmin.php allows users with administrator privileges to upload files to the gwtemp/a/ directory. Due to insufficient...

CVE-2013-10067

Glossword (versions 1.8.8–1.8.12) contains an authenticated arbitrary file upload flaw in the gw_admin.php interface. Insufficient validation of file type/path allows an administrator to upload PHP payloads to gw_temp/a/, enabling remote code execution. Public advisories and a Metasploit module r...

PT-2025-32059 · Kenwood · Kenwood Dmx958Xr

Name of the Vulnerable Software and Affected Versions: Kenwood DMX958XR affected versions not specified Description: This issue allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices without authentication. The flaw resides within the...

PT-2025-32063 · Kenwood · Kenwood Dmx958Xr

Name of the Vulnerable Software and Affected Versions: Kenwood DMX958XR affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected devices. Authentication is not required for exploitation. The flaw resides within the ReadMVGImag...