CVE-2025-2730 H3C Magic BE18000 HTTP POST Request getssidname command injection

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to...

CVE-2025-2730 H3C Magic BE18000 HTTP POST Request getssidname command injection

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is an unknown function of the file /api/wizard/getssidname of the component HTTP POST Request Handler. The manipulation leads to...

CVE-2025-2729 H3C Magic BE18000 HTTP POST Request networkSetup command injection

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to...

CVE-2025-2729

The CVE-2025-2729 entry applies to H3C Magic NX15, NX30 Pro, NX400, R3010, and BE18000 (up to V100R014). The issue is an unauthorized remote command injection in the HTTP POST /api/wizard/networkSetup handler. Attacks require local-network access; public disclosure of exploits is noted. Impact is...

CVE-2025-2729 H3C Magic BE18000 HTTP POST Request networkSetup command injection

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to...

CVE-2025-2727 H3C Magic NX30 Pro HTTP POST Request getNetworkStatus command injection

A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required...

CVE-2025-2727 H3C Magic NX30 Pro HTTP POST Request getNetworkStatus command injection

A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required...

CVE-2025-2726 H3C Magic BE18000 HTTP POST Request esps command injection

A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this issue is some unknown functionality of the file /api/esps of the component HTTP POST Request Handler. The manipulation...

CVE-2025-2726 H3C Magic BE18000 HTTP POST Request esps command injection

A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this issue is some unknown functionality of the file /api/esps of the component HTTP POST Request Handler. The manipulation...

CVE-2025-2725 H3C Magic BE18000 HTTP POST Request auth command injection

A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads ...

CVE-2025-2725 H3C Magic BE18000 HTTP POST Request auth command injection

A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads ...

CVE-2025-2725

The CVE-2025-2725 vulnerability affects H3C Magic NX15, NX30 Pro, NX400, R3010, and BE18000 up to version V100R014, in the HTTP POST /api/login/auth handler. The issue is a command-injection in an unknown functionality of that endpoint. Multiple sources describe remote exposure possibilities, wit...

CVE-2025-2717

A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub41710C of the file /goform/diagnslookup of the component HTTP POST Request Handler. The manipulation of the argument targetaddr leads to os command injection. The...

CVE-2025-2717

A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub41710C of the file /goform/diagnslookup of the component HTTP POST Request Handler. The manipulation of the argument targetaddr leads to os command injection. The...

Dolphin Pro 7.4.2 Cross Site Scripting

Dolphin Pro version 7.4.2 suffers from a persistent cross site scripting vulnerability. Exploit Title: Stored XSS via Send Message Functionality - dolphin.prov7.4.2 Date: 03/2025 Exploit Author: Andrey Stoykov Version: 7.4.2 Date: 03/2025 Tested on: Debian 12 Blog:...

CVE-2025-2717: Improper Neutralization of Special Elements used in an OS Command

A vulnerability, which was classified as critical, has been found in D-Link DIR-823X 240126/240802. This issue affects the function sub41710C of the file /goform/diagnslookup of the component HTTP POST Request Handler. The manipulation of the argument targetaddr leads to os command injection. The...

CVE-2025-29635

The D-Link DIR-823X wireless router (including firmware versions 240126 and 240802 ) is vulnerable to a command injection vulnerability. The root cause is a failure to properly filter command special characters in the /goform/set_prohibiting function within the microprogramming software. An autho...

CVE-2025-2725: Improper Neutralization of Special Elements used in a Command

A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads ...

CVE-2025-2726: Improper Neutralization of Special Elements used in a Command

A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this issue is some unknown functionality of the file /api/esps of the component HTTP POST Request Handler. The manipulation...

CVE-2025-2727: Improper Neutralization of Special Elements used in a Command

A vulnerability, which was classified as critical, was found in H3C Magic NX30 Pro up to V100R007. This affects an unknown part of the file /api/wizard/getNetworkStatus of the component HTTP POST Request Handler. The manipulation leads to command injection. Access to the local network is required...