CVE-2024-27683

D-Link Go-RT-AC750 GORTAC750A1FWv101b03 contains a stack-based buffer overflow via the function hnapmain. An attacker can send a POST request to trigger the vulnerablilify...

TP-LINK AC1350 Denial of Service Vulnerability

The TP-LINK AC1350 is a router from China P&L TP-LINK. A security vulnerability exists in the TP-LINK AC1350, which can be exploited by an attacker to cause a denial of service in the device's web interface via a specially crafted HTTP POST request...

CVE-2023-40148 PingFederate Server Side Request Forgery vulnerability

Server-side request forgery SSRF in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests...

PT-2024-2877 · Tenda · Tenda Ac500

Name of the Vulnerable Software and Affected Versions: Tenda AC500 version 2.0.1.91307 Description: A critical issue affects the formQuickIndex function of the /goform/QuickIndex file, leading to a stack-based buffer overflow when the PPPOEPassword argument is manipulated. This can be exploited...

CVE-2023-48724

CVE-2023-48724 affects the TP-Link AC1350 Wireless MU-MIMO G igabit Access Point (EAP225 V3), affected firmware v5.1.0 Build 20220926. Talos reports a memory corruption bug in the web interface (httpd_portal) caused by parsing x-www-form-urlencoded POST parameters in the web UI, leading to a deni...

CVE-2023-48724

A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3 v5.1.0 Build 20220926. A specially crafted HTTP POST request can lead to denial of service of the device's web interface. An attacker can send an...

CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

CVE-2024-28270

CVE-2024-28270 affects web-flash v3.0. A vulnerability allows an attacker to reset passwords for arbitrary users by sending a crafted POST request to /prod-api/user/resetPassword. CVSS v3.1 base score 8.1 (HIGH); attack vector NETWORK, complexity LOW, privileges LOW, user interaction NONE, with c...

CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

web-flash 安全漏洞

web-flash is an enilu open source web system based on Spring Boot and Vue.js. A security vulnerability exists in web-flash version v3.0, which originated from a vulnerability that allows an attacker to reset an arbitrary user's password via a crafted POST request...

PsiTransfer: Violation of the integrity of file distribution

Summary The absence of restrictions on the endpoint, which allows you to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. Details Vulnerable endpoint: POST /files PoC 1. Create a file distribution. 2. Go to the link address ...

GHSA-XG8V-M2MH-45M6 PsiTransfer: Violation of the integrity of file distribution

Summary The absence of restrictions on the endpoint, which allows you to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. Details Vulnerable endpoint: POST /files PoC 1. Create a file distribution. 2. Go to the link address ...

Gibbon School Platform 26.0.00 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Gibbon School Platform Authenticated PHP Deserialization Vulnerability', 'Description' = %q A Remote Code Execution vulnerability in Gibbon onlin...

CVE-2024-29025

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...

WordPress Alemha Watermarker 1.3.1 Cross Site Scripting

Exploit Title: Wordpress Plugin Alemha Watermarker 1.3.1 - Stored Cross-Site Scripting XSS Date: 22 March 2024 Exploit Author: Erdemstar Vendor: https://wordpress.com/ Version: 1.3.1 Proof Of Concept: 1. Click Add New Watermark and enter the XSS payload into the Watermark Text. 2. Stored XSS will...

Axigen < 10.5.7 - Persistent Cross-Site Scripting

Exploit Title: Axigen alert1 PoC of the POST request: POST /?h=1bb40e85937506a7186a125bd8c5d7ef&page=glset HTTP/1.1 Host: localhost:9443 Cookie: eula=true;...

The vulnerability of the fromSetWirelessRepeat function (/goform/WifiExtraSet) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromSetWirelessRepeat function /goform/WifiExtraSet in the Tenda AC7 router microprogramming system is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

The vulnerability of the setSchedWifi function (/goform/openSchedWifi) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setSchedWifi function /goform/openSchedWifi in the Tenda AC7 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

The vulnerability of the GetParentControlInfo function (/goform/GetParentControlInfo) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of GetParentControlInfo /goform/GetParentControlInfo in the Tenda AC7 router software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information through ...

The vulnerability of the fromSetWifiGuestSetBasic function (/goform/WifiGuestSet) in the Tenda AC7 router software allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromSetWifiGuestSetBasic function /goform/WifiGuestSet in the Tenda AC7 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of...