CVE-2025-50902

Cross Site Request Forgery CSRF vulnerability in old-peanut Open-Shop aka old-peanut/wechatappletopensource thru 1.0.0 allows attackers to gain sensitive information via crafted HTTP Post message...

CVE-2025-50902

CVE-2025-50902 describes a CSRF vulnerability in the old-peanut Open-Shop project (aka old-peanut/wechat_applet__open_source) up to version 1.0.0. The underlying issue is a CSRF flaw that could allow an attacker to obtain sensitive information via crafted HTTP POST requests. Affected software is ...

PT-2025-34148 · Old Peanut · Open-Shop

Name of the Vulnerable Software and Affected Versions: old-peanut Open-Shop versions through 1.0.0 Description: A Cross Site Request Forgery CSRF issue exists in old-peanut Open-Shop, allowing attackers to obtain sensitive information via a crafted HTTP Post message. Recommendations: At the momen...

Linux Distros Unpatched Vulnerability : CVE-2025-3891

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the modauthopenidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an...

CVE-2025-55346

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-43984

An issue was discovered on KuWFi GC111 devices Hardware Version: CPE-LM321V3.2, Software Version: GC111-GL-LM321V3.020191211. They are vulnerable to unauthenticated /goform/goformsetcmdprocess requests. A crafted POST request, using the SSID parameter, allows remote attackers to execute arbitrary...

GHSA-Q4XX-MC3Q-23X8 Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hmgh-466j-fx4c. This link is maintained to preserve external references. Original Description User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers...

Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hmgh-466j-fx4c. This link is maintained to preserve external references. Original Description User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers...

CVE-2025-55346

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-55346 Unintended dynamic code execution leads to remote code execution by network attackers

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-55346 Unintended dynamic code execution leads to remote code execution by network attackers

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-55346

Flowise exposes a remote code execution vector via the CustomMCP tool: input from mcpServerConfig is passed into a dynamic Function constructor (Function('return '+ input)()) in the host context, which can access global process and Node.js modules. This allows arbitrary JS execution (RCE) when cr...

PT-2025-33143

Name of the Vulnerable Software and Affected Versions: Flowise JS affected versions not specified Description: User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host by...

CVE-2025-43984

CVE-2025-43984 affects KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2; Software Version: GC111-GL-LM321_V3.0_20191211). An unauthenticated POST to the endpoint /goform/goform_set_cmd_process , using the SSID parameter, allows remote attackers to execute arbitrary OS commands with root priv...

PT-2025-33282 · Kuwfi · Kuwfi Gc111

Name of the Vulnerable Software and Affected Versions: KuWFi GC111 versions GC111-GL-LM321 V3.0 20191211 Description: The KuWFi GC111 device is susceptible to unauthorized command execution. A crafted POST request to the /goform/goform set cmd process API endpoint, utilizing the SSID parameter,...

CVE-2011-10011

CVE-2011-10011 affects WeBid 1.0.2. The vulnerability is a remote PHP code injection in converter.php: unsanitized input from the to parameter of a POST request is written to includes/currencies.php, allowing an unauthenticated attacker to inject arbitrary PHP code and achieve persistent remote c...

The vulnerability of the wirelessBasic() function in the mod_form.so script of Linksys routers such as RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the wirelessBasic function in the modform.so microprogramming system for Linksys routers such as RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 lies in the fact that the operation’s output escapes the buffer in memory when processing the submitSSID1 parameter. Exploiting...

The vulnerability of the um_rp_autochannel() function in the microprogramming software for Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 allows a hacker to execute arbitrary code.

The vulnerability of the umrpautochannel function in the microprogramming software for Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 lies in the fact that the operation’s output escapes the buffer and is stored in memory when processing the apcliAuthMode2G and apcliAuthMode5G...

CVE-2012-10047

Cyclope Employee Surveillance Solution versions 6.x is vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a...

The vulnerability of the FUN_00425fd8() function (/biurl_grou) of the D-Link DIR-632 router’s microprogramming software allows a hacker to induce a service failure.

The vulnerability of the FUN00425fd8 function /biurlgrou of the D-Link DIR-632 router’s microprogramming system is related to the output of operations that go beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially...