CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

CVE-2024-3150

In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. The issue arises from improper input validation when handling HTTP POST requests to the endpoint...

CVE-2024-1601

An SQL injection vulnerability exists in the deletediscussion function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data. The vulnerability is exploitable via a crafted HTTP POST request to the /deletediscussion endpoint, which internally...

The vulnerability of the SetCmdlineRun function (/goform/SetCmdlineRun) in the Tenda A18 router microprogramming system allows a attacker to cause a service failure.

The vulnerability of the SetCmdlineRun function /goform/SetCmdlineRun in the Tenda A18 router microprogramming system is related to buffer overflow in the stack. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially crafted POST request wi...

CVE-2024-13200

A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/com/my/blog/website/interceptor/BaseInterceptor.java of the component HTTP POST Request Handler. The manipulation leads to improper access...

CVE-2024-8124

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of Service via sending a specific POST request...

CVE-2024-40890

CVE-2024-40890 affects Zyxel VMG4325-B10A legacy DSL CPE. The vulnerability is a post-authentication command-injection flaw in the device’s CGI program, exploitable by sending a crafted HTTP POST request to execute OS commands with elevated privileges (reported for firmware 1.00(AAFR.4)C0_2017061...

CVE-2025-0848

A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapskcrypto5g leads to stack-based buffer overflow...

CVE-2025-0848 Tenda A18 HTTP POST Request SetCmdlineRun stack-based overflow

A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapskcrypto5g leads to stack-based buffer overflow...

CVE-2025-0848 Tenda A18 HTTP POST Request SetCmdlineRun stack-based overflow

A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapskcrypto5g leads to stack-based buffer overflow...

CVE-2025-0848

The CVE-2025-0848 entry concerns the Tenda A18 router (versions up to 15.13.07.09) with a vulnerability in the HTTP POST handler function SetCmdlineRun. The root cause is a stack-based buffer overflow triggered by manipulating the wpapsk_crypto5g argument, which can be exploited remotely. Public ...

mySCADA myPRO 操作系统命令注入漏洞

mySCADA myPRO is a professional HMI/SCADA system from mySCADA, Inc. designed for the visualization and control of industrial processes. An operating system command injection vulnerability exists in mySCADA myPRO that stems from an inability to properly neutralize a POST request with an email...

CVE-2024-57595

DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apcclientpin.cgi, which allows remote attackers to execute arbitrary commands via the parameter "wpspin" passed to the apcclientpin.cgi binary through a POST request...

CVE-2024-57590

TRENDnet TEW-632BRP v1.010B31 is affected by an OS command injection in the CGl interface ntp_sync.cgi. The vulnerability allows a remote attacker to execute arbitrary commands by sending a crafted ntp_server parameter in a POST request to ntp_sync.cgi. CVSS v3.1 base score 9.8 (CRITICAL) with Ne...

D-Link DIR-816A2 websURLFilterAddDel Component Access Control Error Vulnerability

The D-Link DIR-816A2 is a router from China's AUO D-Link. The D-Link DIR-816A2 suffers from an Access Control Error vulnerability that stems from improper access control of the websURLFilterAddDel component, which can be exploited by an unauthenticated attacker to set up filtering rules via a...

The vulnerability of the formSetDeviceName and sub_C6BB0 functions in the Tenda AC18 router’s microprogramming system allows a hacker to induce a service failure.

The vulnerability of the formSetDeviceName and subC6BB0 functions in the Tenda AC18 router’s microprogramming system lies in the possibility of copying input data into the buffer without checking its size. Exploiting this vulnerability could allow a malicious actor to cause a service failure by...

The vulnerability in the /goform/form2NetSniper.cgi microprogramming of the D-Link DIR-816 A2 wireless router allows a intruder to gain unauthorized access to protected information.

The vulnerability of the /goform/form2NetSniper.cgi microprogramming software for D-Link DIR-816 A2 wireless routers is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information by sendin...

D-Link DIR-878 Information Disclosure Vulnerability

The D-Link DIR-878 is a wireless router from China's AUO D-Link. An information disclosure vulnerability exists in the D-Link DIR-878 version 1.03, which stems from insufficient protection of sensitive information in the component HTTP POST request handler, and can be exploited by an attacker to...

CVE-2024-57681

An access control issue in the component form2alg.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request...

CVE-2024-57680

An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request...