CVE-2019-25493

Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'val' parameter. Attackers can send GET requests to the admin/getrecord.php endpoint with malicious 'val' values to extract sensitive databas...

CVE-2025-63213

The QVidium Opera11 device firmware version 2.9.0-Ax4x-opera11 is vulnerable to Remote Code Execution RCE due to improper input validation on the /cgi-bin/netping.cgi endpoint. An attacker can exploit this vulnerability by sending a specially crafted GET request with a malicious parameter to inje...

EUVD-2017-5540

Malware in sbrugna...

EUVD-2024-47533

Malicious code in bioql PyPI...

insightsoftware Spark JDBC 安全漏洞

insightsoftware Spark JDBC is a data connectivity driver from insightsoftware. It supports Spark access to multiple databases A security vulnerability exists in insightsoftware Spark JDBC version 2.6.21, which stems from malicious parameter injection that could lead to remote code execution...

CVE-2024-6433

The application zips all the files in the folder specified by the user, which allows an attacker to read arbitrary files on the system by providing a crafted path. This vulnerability can be exploited by sending a request to the application with a malicious snapshotpath parameter...

CVE-2024-53274

Habitica (open‑source habit builder) is affected by CVE-2024-53274. The vulnerability is a reflected XSS in the /home context via the register function in home.vue, caused by an insufficient sanitization function. An attacker can abuse a malicious redirectTo parameter to execute arbitrary JavaScr...

Cross-Site Scripting (XSS)

github.com/mattermost/mattermost-server is vulnerable to Cross-Site Scripting XSS attacks. An attacker is able to send AJAX requests on behalf of the victim through OAuth flow completion endpoints via sharing a crafted link with a malicious state parameter...

Remote Code Execution

total.js is vulnerable to remote code execution. The vulnerability exists in set of utils.js where it does not validate malicious parameter being injected and executed by a malicious user...

Cross site scripting

DISPUTED Reflected Cross-Site Scripting vulnerability in "Design" on "Edit device layout" in Kentico 9 through 11 allows remote attackers to execute malicious JavaScript via a malicious devicename parameter in a link that is entered via the "Pages - Edit template properties - Device Layouts -...