The vulnerability of the web interface of Xerox WorkCentre 3025 microprogramming software allows a perpetrator to gain unauthorized access to account data.

The vulnerability of the web interface of Xerox WorkCentre 3025 microprogramming software is related to the improper processing of special symbols in input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to account information by sending a specially crafted...

CVE-2025-20147

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack XSS on an affected system. This vulnerability is due to improper sanitization of use...

CVE-2025-20147 Cisco SD-WAN vManage Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack XSS on an affected system. This vulnerability is due to improper sanitization of use...

CVE-2025-20216

Cisco CVE-2025-20216 affects Cisco Catalyst SD-WAN Manager (formerly vManage). The issue is HTML injection via the web interface due to improper input sanitization. An unauthenticated, remote attacker could entice an authenticated user to click a malicious link, injecting HTML into the user’s bro...

CVE-2025-20216 Cisco Catalyst SD-WAN Manager Reflected HTML Injection Vulnerability

A vulnerability in the web interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to inject HTML into the browser of an authenticated user. This vulnerability is due to improper sanitization of input to the web interface. An...

PT-2025-20278 · Cisco · Cisco Catalyst Sd-Wan Manager

Name of the Vulnerable Software and Affected Versions: Cisco Catalyst SD-WAN Manager affected versions not specified Description: A vulnerability in the web interface could allow an unauthenticated, remote attacker to inject HTML into the browser of an authenticated user. This issue is due to...

RHEL 8 : thunderbird (RHSA-2025:4654)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:4654 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: User Interface UI Misrepresentation of attachmen...

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: User Interface UI Misrepresentation of attachment URL CVE-2025-3523 thunderbird: Information Disclosure of /tmp directory listing CVE-2025-2830 thunderbird: Leak of hashed Window credentials via crafted...

RHEL 8 : thunderbird (RHSA-2025:4649)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:4649 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: User Interface UI Misrepresentation of attachmen...

ALSA-2025:4649 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: User Interface UI Misrepresentation of attachment URL CVE-2025-3523 thunderbird: Information Disclosure of /tmp directory listing CVE-2025-2830 thunderbird: Leak of hashed Window credentials via crafted...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration through the Session API. An attacker can authenticate on behalf of the user by repeatedly using idp intents to retrieve the id and token from the application's URI. Remediation Upgrade...

UBUNTU-CVE-2025-4215

A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the file src/js/1p-filters.js of the component UI. The manipulation leads to inefficient regular expression complexity. It is possible to laun...

The vulnerability of the web interface of the AvertX network IP camera’s software allows a intruder to gain access to the video stream.

The vulnerability of the web interface of the AvertX network IP camera’s microprogramming software is related to the disclosure of information due to incompatibility. Exploiting this vulnerability can allow a remote attacker to gain access to the video stream...

CVE-2025-25427

A stored cross-site scripting XSS vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 = Build 241230 Rel. 50788n allows remote attackers to inject arbitrary JavaScript code via the port mapping description. This leads to an execution of the JavaScript payload...

Exploit for OS Command Injection in Raisecom Msg2300_Firmware

This is a PoC exploit for CVE-2024-7120, a vulnerability in an u...

CVE-2025-2771

CVE-2025-2771 concerns BEC Technologies routers with an authentication bypass in the web-based UI, allowing remote attackers to access functionality without credentials. The vulnerability stems from lack of authentication prior to accessing UI functions. Connected sources (ZDI advisory ZDI-25-184...

The vulnerability of the doUpdate function in the web interface of TP-Link’s router software, TL-WR841N, allows a hacker to inject any JavaScript code.

The vulnerability of the doUpdate function in the web interface of TP-Link’s router software, the TL-WR841N, is related to a deficiency in the upnpTbl filter parameter when accessing the UPnP.html web page. Exploiting this vulnerability allows an attacker to inject arbitrary JavaScript code by...

CVE-2025-25427

A stored cross-site scripting XSS vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 = Build 241230 Rel. 50788n allows remote attackers to inject arbitrary JavaScript code via the port mapping description. This leads to an execution of the JavaScript payload...

PT-2025-20915 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version 4.0.0-B20230531.1404 Description: A buffer overflow issue was discovered via the addrPoolEnd parameter in the "formDhcpv6s" interface. Recommendations: For TOTOLINK A3002R version 4.0.0-B20230531.1404, as a temporary...

The vulnerability of the graphical interface of the Fortinet FortiDeceptor tool for detecting and responding to external and internal security threats allows a perpetrator to execute arbitrary code.

The vulnerability of the graphical interface of the Fortinet FortiDeceptor tool for detecting and responding to external and internal security threats is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute...