CVE-2025-3539

CVE-2025-3539 - Technical summary (mode C) Affected products: H3C Magic NX15, NX30 Pro, NX400, R3010, BE18000 up to version V100R014. The vulnerability resides in the function FCGI_CheckStringIfContainsSemicolon of the file "/api/wizard/getBasicInfo" within the HTTP POST Request Handler . Root ca...

CVE-2025-3539 H3C Magic BE18000 HTTP POST Request getBasicInfo FCGI_CheckStringIfContainsSemicolon command injection

A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is the function FCGICheckStringIfContainsSemicolon of the file /api/wizard/getBasicInfo of the component HTTP POST Request Handler. The...

CVE-2025-3538

A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function authasp of the file /auth.asp of the component jhttpd. The manipulation of the argument callback leads to stack-based buffer overflow. The attack needs to be approached within th...

CVE-2025-3538

A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function authasp of the file /auth.asp of the component jhttpd. The manipulation of the argument callback leads to stack-based buffer overflow. The attack needs to be approached within th...

CVE-2025-3538

CVE-2025-3538 affects D-Link DI-8100 (version 16.07.26A1) via the vulnerable jhttpd component: the function in /auth.asp named auth_asp does not properly validate the input length, allowing a stack-based buffer overflow when manipulating the argument callback . Impact is high (confidentiality, in...

CVE-2025-3538 D-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflow

A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function authasp of the file /auth.asp of the component jhttpd. The manipulation of the argument callback leads to stack-based buffer overflow. The attack needs to be approached within th...

CVE-2025-3538 D-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflow

A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function authasp of the file /auth.asp of the component jhttpd. The manipulation of the argument callback leads to stack-based buffer overflow. The attack needs to be approached within th...

PT-2025-16192 · H3C · H3C Magic Nx15 +2

Name of the Vulnerable Software and Affected Versions: H3C Magic NX15 versions up to V100R014 H3C Magic NX400 versions up to V100R014 H3C Magic R3010 versions up to V100R014 Description: A critical issue was found in the affected devices, which affects the FCGI WizardProtoProcess function of the...

PT-2025-16187

Name of the Vulnerable Software and Affected Versions: H3C Magic NX15 versions up to V100R014 H3C Magic NX30 Pro versions up to V100R014 H3C Magic NX400 versions up to V100R014 H3C Magic R3010 versions up to V100R014 H3C Magic BE18000 versions up to V100R014 Description: A critical issue has been...

PT-2025-16190 · H3C · H3C Magic Nx15 +3

Name of the Vulnerable Software and Affected Versions: H3C Magic NX15 versions up to V100R014 H3C Magic NX30 Pro versions up to V100R014 H3C Magic NX400 versions up to V100R014 H3C Magic R3010 versions up to V100R014 Description: A critical vulnerability was found in the H3C Magic NX series,...

ABB Cylon FLXeon 9.3.4 - Cross-Site Request Forgery

Exploit title: ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series FBXi Series, FBTi Series, FBVi Series CBX Series FLX Series CBT Series CBV Series Firmware: =9.3.4 Summary: BACnet® Smart Building...

CVE-2025-3329

A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack...

CVE-2025-3329

A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack...

CVE-2025-3329

A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack...

CVE-2025-3329 Consumer Comanda Mobile Restaurant Order cleartext transmission

A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack...

CVE-2025-3329

CVE-2025-3329 affects Consumer Comanda Mobile (versions 14.9.3.2 through 15.0.0.8) in the Restaurant Order Handler component. The issue is the manipulation of the Login/Password argument, which results in sensitive information being transmitted in clear text. Exploitation requires proximity (loca...

CVE-2025-3329 Consumer Comanda Mobile Restaurant Order cleartext transmission

A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack...

CVE-2025-32358

In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain conditions are met. If a webhook endpoint returned a redirect response, Zammad would follow it automatically with another GET request. This coul...

PT-2025-15129 · Unknown · Consumer Comanda Mobile

Name of the Vulnerable Software and Affected Versions: Consumer Comanda Mobile versions 14.9.3.2 through 15.0.0.8 Description: A problematic issue has been found in Consumer Comanda Mobile, affecting an unknown part of the Restaurant Order Handler component. The manipulation of the Login/Password...

PT-2025-15071 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions 6.4.0 through 6.4.1 Description: The issue allows for Server-Side Request Forgery SSRF to occur. Authenticated admin users can enable webhooks, which are triggered as POST requests when certain conditions are met. If a webhook...