The vulnerability in the web interface of the Cisco Prime Infrastructure monitoring and management system, as well as the Cisco Evolved Programmable Network Manager (EPNM) software for managing network services, allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the web interface for managing Cisco Prime Infrastructure network equipment and the Cisco Evolved Programmable Network Manager EPNM software lies in the insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to perform...

The vulnerability of the web interface of the “Central Archive of Medical Images” information system, which stems from the lack of protective measures for the website structure, allows attackers to gain unauthorized access to the protected information.

The vulnerability of the web interface of the “Central Archive of Medical Images” information system is related to the lack of protective measures for the website structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the protected...

The vulnerability in the web interface for managing micro-program software on Cisco Expressway allows a hacker to redirect users to any arbitrary URL address.

The vulnerability of the web interface for managing microprogramming software in Cisco Expressway is related to the use of open redirection. Exploiting this vulnerability allows a malicious actor to redirect users to any arbitrary URL address...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files, increase their privileges, and execute arbitrary commands.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to load arbitrary files, increase their privileges, and execute arbitrary commands...

DEBIAN-CVE-2024-42325

Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc...

CVE-2024-54806

Netgear WNR854T 1.5.2 North America is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web interface...

The vulnerability of the ADI web interface of the Verve Asset Manager software allows a perpetrator to execute arbitrary commands within the context of the Agentless Device Inventory.

The vulnerability of the ADI web interface of the Verve Asset Manager software solution is related to the failure to take measures to neutralize certain special elements. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary commands within the...

The vulnerability of the web interface of Moxa network device software for models EDF-G1002-BP, EDR-810, EDR-8010, EDR-G9004, EDR-G9010, NAT-102, TN-4900, and OnCell G4302-LTE4 allows a perpetrator to execute arbitrary commands through NTP settings, thereby gaining full control over the device.

The vulnerability of the web interface of Moxa network devices of the EDF-G1002-BP, EDR-810, EDR-8010, EDR-G9004, EDR-G9010, NAT-102, TN-4900, and OnCell G4302-LTE4 series is related to the lack of measures to neutralize specific components. Exploiting this vulnerability allows a malicious actor ...

The vulnerability of the GUI component of the FortiSandbox threat detection and mitigation system allows a perpetrator to execute arbitrary commands.

The vulnerability of the GUI component of the FortiSandbox threat detection and mitigation system is related to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability in the web interface of Netgear WNR854T router software allows a hacker to execute arbitrary commands and gain full control over the device.

The vulnerability of the web interface of Netgear WNR854T router software lies in the lack of measures to neutralize special elements used in the operating system’s commands when processing the wanhostname parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

CVE-2025-27405

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows an attacker to craft a URL that, once visited by any user, allows to embed arbitrary Javascript into Icinga Web and to act on behalf of tha...

The vulnerability of the web interface of the cross-platform FTP server CrushFTP allows a hacker to gain unauthorized access to the software.

The vulnerability of the cross-platform FTP server CrushFTP lies in the deficiencies of its authentication process. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to the software by sending a specially crafted HTTP request...

(0Day) BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of BEC Technologies routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from storing credentials in...

(0Day) BEC Technologies Multiple Routers Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based user interface. The issue results from the lack of authentication...

PT-2025-12849 · Bec Technologies · Bec Technologies Multiple Routers

Name of the Vulnerable Software and Affected Versions: BEC Technologies Multiple Routers affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of BEC Technologies Multiple Routers. Although authentication is required to...

Schneider Electric EcoStruxure Power Automation System User Interface Authorization Issue Vulnerability

Schneider Electric EcoStruxure Power Automation System User Interface is a Schneider Electric user interface software for power automation systems from Schneider Electric France. It is used for operators to interact with the power automation system to improve operational efficiency. The Schneider...

GPT Academic 访问控制错误漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from an Access Control Error vulnerability that could be exploited by an attacker to cause unauthorized operations...

AnythingLLM 安全漏洞

AnythingLLM is an all-in-one AI application open-sourced by Mintplex. A security vulnerability exists in version 6dc3642 of AnythingLLM, which stems from an unauthenticated denial of service in the API embedded in the chat functionality, which allows an attacker to cause the server to crash by...

CVE-2025-2361

CVE-2025-2361 affects Mercurial SCM’s Web Interface (hgweb). A cross-site scripting vulnerability arises from improper sanitization of user-controlled input passed via the cmd parameter in the Web Interface, enabling remote exploitation. Affected is Mercurial 4.5.3/71.19.145.211 with hgweb; multi...

The vulnerability of the web interface of the IBM Sterling B2B Integrator software allows a perpetrator to execute arbitrary code and gain unauthorized access to protected information.

The vulnerability of the web interface of the IBM Sterling B2B Integrator software solution relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and gain unauthorized access to protected...