CVE-2025-54174: Cross-Site Request Forgery (CSRF)

QuickCMS is vulnerable to Cross-Site Request Forgery in article creation functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request creating a malicious article with content defined by the attacker. The vendor was notified...

CVE-2025-50902

Cross Site Request Forgery CSRF vulnerability in old-peanut Open-Shop aka old-peanut/wechatappletopensource thru 1.0.0 allows attackers to gain sensitive information via crafted HTTP Post message...

PT-2025-34148 · Old Peanut · Open-Shop

Name of the Vulnerable Software and Affected Versions: old-peanut Open-Shop versions through 1.0.0 Description: A Cross Site Request Forgery CSRF issue exists in old-peanut Open-Shop, allowing attackers to obtain sensitive information via a crafted HTTP Post message. Recommendations: At the momen...

TOTOLink T6 System Code Execution

The vulnerability of the tcpchecknet microprogramming software used in the TOTOLink T6 mesh system lies in the lack of measures taken to protect data at the management level when processing the domain parameter. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2025-3891

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the modauthopenidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an...

CVE-2025-55346

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-43984

An issue was discovered on KuWFi GC111 devices Hardware Version: CPE-LM321V3.2, Software Version: GC111-GL-LM321V3.020191211. They are vulnerable to unauthenticated /goform/goformsetcmdprocess requests. A crafted POST request, using the SSID parameter, allows remote attackers to execute arbitrary...

Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hmgh-466j-fx4c. This link is maintained to preserve external references. Original Description User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers...

GHSA-Q4XX-MC3Q-23X8 Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hmgh-466j-fx4c. This link is maintained to preserve external references. Original Description User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers...

CVE-2025-55346

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-55346 Unintended dynamic code execution leads to remote code execution by network attackers

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-55346 Unintended dynamic code execution leads to remote code execution by network attackers

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-55346

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-55346

Flowise exposes a remote code execution vector via the CustomMCP tool: input from mcpServerConfig is passed into a dynamic Function constructor (Function('return '+ input)()) in the host context, which can access global process and Node.js modules. This allows arbitrary JS execution (RCE) when cr...

PT-2025-33282 · Kuwfi · Kuwfi Gc111

Name of the Vulnerable Software and Affected Versions: KuWFi GC111 versions GC111-GL-LM321 V3.0 20191211 Description: The KuWFi GC111 device is susceptible to unauthorized command execution. A crafted POST request to the /goform/goform set cmd process API endpoint, utilizing the SSID parameter,...

PT-2025-33143

Name of the Vulnerable Software and Affected Versions: Flowise JS affected versions not specified Description: User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host by...

CVE-2025-43984

The KuWFi GC111 router (Hardware Version: CPE-LM321_V3.2 , Software Version: GC111-GL-LM321_V3.0_20191211 ) is vulnerable to an unauthenticated OS command injection vulnerability. A crafted POST request to the /goform/goform_set_cmd_process API endpoint, specifically targeting the SSID parameter,...

CVE-2025-55346: Improper Control of Generation of Code

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2011-10011

CVE-2011-10011 affects WeBid 1.0.2. The vulnerability is a remote PHP code injection in converter.php: unsanitized input from the to parameter of a POST request is written to includes/currencies.php, allowing an unauthenticated attacker to inject arbitrary PHP code and achieve persistent remote c...

PT-2025-40258

Уязвимость встроенного программного обеспечения ПЛК Fastwel связана с использованием опасных методов или функций. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольные команды операционной системы и повысить свои привилегии до уровня суперпользователя...