D-Link DIR-823X Null Pointer Dereference Vulnerability

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a null pointer dereference vulnerability that originates in the parameter macList in the setwifiblacklists function of the file /goform/setwifiblacklists in the component HTTP POST request handler,...

CVE-2025-1360

A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msgto leads to cross site scripting. It is...

CVE-2025-1360 Internet Web Solutions Sublime CRM HTTP POST Request inicio.php cross site scripting

A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msgto leads to cross site scripting. It is...

CVE-2025-1360 Internet Web Solutions Sublime CRM HTTP POST Request inicio.php cross site scripting

A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the file /crm/inicio.php of the component HTTP POST Request Handler. The manipulation of the argument msgto leads to cross site scripting. It is...

CVE-2025-1360

Summary: CVE-2025-1360 affects Internet Web Solutions Sublime CRM up to version 20250207. The vulnerability exists in the HTTP POST Request Handler, specifically an unknown function in the file /crm/inicio.php, where manipulation of the msg_to parameter leads to cross-site scripting. It can be ex...

CVE-2025-1270

Insecure direct object reference IDOR vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/hadatoshermano.php” endpoint to refer to another user. In addition, the...

CVE-2025-25357

A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the email POST request parameter...

CVE-2025-25387

A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the propertytype POST request parameter...

The vulnerability in the apc_client_pin.cgi script of D-Link DIR-825 router software allows a hacker to execute arbitrary commands.

The vulnerability in the apcclientpin.cgi script of D-Link DIR-825 router microprogramming software exists due to the failure to implement measures to neutralize special elements used in the operating system’s command for processing the wpspin parameter. Exploiting this vulnerability allows a...

CVE-2025-26156

A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter...

CVE-2023-2573

Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be triggered by authenticated users via a crafted POST request...

CVE-2025-25357

A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the email POST request parameter...

CVE-2025-25356

A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the " todate" POST request parameter...

CVE-2025-1270 Insecure direct object reference (IDOR) vulnerability in H6Web

Insecure direct object reference IDOR vulnerability in Anapi Group's h6web, allows an authenticated attacker to access other users' information by making a POST request and modifying the “pkrelated” parameter in the “/h6web/hadatoshermano.php” endpoint to refer to another user. In addition, the...

CVE-2025-25356

CVE-2025-25356 affects PHPGurukul Land Record System v1.0. The vulnerability is a SQL injection in /admin/bwdates-reports-details.php, exploitable via the todate parameter in a POST request, potentially allowing remote code execution. Reported metrics indicate a HIGH severity (CVSS v3.1: 7.2) wit...

CVE-2024-56908

Perfex CRM versions before 3.2.1 are affected by CVE-2024-56908. An authenticated attacker can issue a crafted HTTP POST to the upload_sales_file endpoint and supply malicious input in the rel_id parameter, taking advantage of improper input validation to bypass restrictions and upload arbitrary ...

GatesAir Maxiva 安全漏洞

GatesAir Maxiva is a series of transmitters from GatesAir USA. A security vulnerability exists in the GatesAir Maxiva UAXT Transmitter and VAXT Transmitter that stems from improperly validated POST request processing when debug mode is enabled, resulting in remote code execution...

CVE-2025-25356

A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the " todate" POST request parameter...

CVE-2025-25355

A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the fromdate POST request parameter...

CVE-2024-56908

In Perfex Crm 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected uploadsalesfile endpoint. By providing malicious input in the relid parameter, combined with improper input validation, the attacker can bypass restrictions and upload arbitrary files to directorie...