CVE-2019-12185

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the we...

CVE-2024-2909

A vulnerability classified as critical was found in Ruijie RG-EG350 up to 20240318. Affected by this vulnerability is the function setAction of the file /itboxpi/networksafe.php?a=set of the component HTTP POST Request Handler. The manipulation of the argument bandwidth leads to os command...

CVE-2024-2271

A vulnerability classified as critical has been found in keerti1924 Online-Book-Store-Website 1.0. This affects an unknown part of the file /shop.php of the component HTTP POST Request Handler. The manipulation of the argument productname leads to sql injection. It is possible to initiate the...

CVE-2025-69227

A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. A remote attacker could exploit this vulnerability by sending a specially crafted POST request to an application using the Request.post method, provided that Python optimizations are enabled. This could lead to ...

AZL-73529 CVE-2025-69227 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled -O or PYTHONOPTIMIZE=1, and the...

AZL-73506 CVE-2025-69227 affecting package python-aiohttp 3.6.2-3

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled -O or PYTHONOPTIMIZE=1, and the...

The vulnerability of the strcpy() function in the microprogramming software for UTT 512W allows a hacker to execute arbitrary code.

The vulnerability of the strcpy function in the UTT 512W router microprogramming system is related to copying buffers without checking the size of the input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted POST request...

CVE-2026-21451 Bagisto has HTML Filter Bypass that Enables Stored XSS

Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting XSS vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize tags, the filtering can be bypassed by manipulating the raw HTTP POST...

CVE-2025-15215

A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the component HTTP POST Request Handler. This manipulation of the argument list causes buffer overflow. It is possible to initiate the attack...

The vulnerability of the sub_42261C() function in D-Link’s router microprogramming systems DWR-M920 and DIR-822K allows a hacker to execute arbitrary code.

The vulnerability of the sub42261C function in D-Link’s router microprogramming systems, DWR-M920 and DIR-822K, is related to the execution of an operation outside the buffer in memory when processing the argumenip6addr. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

The vulnerability of the web interface of the Yealink T21P_E2 microprogramming software for IP phones allows a perpetrator to execute arbitrary code.

The vulnerability of the web interface of Yealink T21PE2 microprogramming software for IP phones is related to the lack of measures taken at the management level to protect data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted POST...

CVE-2022-50791 SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.php

SOUND4 IMPACT/FIRST/PULSE/Eco =2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the vulnerable ping.php script,...

CVE-2022-50789

Summary: CVE-2022-50789 affects SOUND4 IMPACT/FIRST/PULSE/Eco 2.x and earlier. A command injection exists in the dns.php script allowing local authenticated users to create malicious files in /tmp with a .dns.pid extension; an unauthenticated attacker could trigger command execution via a single ...

CVE-2025-15218

The CVE-2025-15218 issue affects Tenda AC10U firmware versions 15.03.06.48–15.03.06.49. The vulnerability lies in the POST Request Parameter Handler, specifically the fromadvsetlanip function in /goform/AdvSetLanip, where manipulating the lanMask argument can trigger a buffer overflow. The impact...

CVE-2025-15218 Tenda AC10U POST Request Parameter AdvSetLanip fromadvsetlanip buffer overflow

A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Parameter Handler. Executing a manipulation of the argument lanMask can lead to buffer overflow. The...

CVE-2025-15218 Tenda AC10U POST Request Parameter AdvSetLanip fromadvsetlanip buffer overflow

A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSetLanip of the component POST Request Parameter Handler. Executing a manipulation of the argument lanMask can lead to buffer overflow. The...

CVE-2025-15217

A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely...

CVE-2025-15217 Tenda AC23 HTTP POST Request formSetPPTPUserList buffer overflow

A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely...

CVE-2025-15217 Tenda AC23 HTTP POST Request formSetPPTPUserList buffer overflow

A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely...

CVE-2025-15217

A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely...