CVE-2025-1175

The vulnerability CVE-2025-1175 is a Reflected Cross-Site Scripting (XSS) in Kelio Visio 1, Kelio Visio X7, and Kelio Visio X4, affecting versions 3.2C through 5.1K. The issue occurs in the editable ‘username’ parameter of the endpoint "/PageLoginVisio.do" and can be triggered by a POST request t...

CVE-2025-1175: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS vulnerability in Kelio Visio 1, Kelio Visio X7 and Kelio Visio X4, in versions between 3.2C and 5.1K. This vulnerability could allow an attacker to execute a JavaScript payload by making a POST request and injecting malicious code into the editable ‘username’...

PT-2025-6040 · Kelio · Kelio Visio X4 +2

Name of the Vulnerable Software and Affected Versions: Kelio Visio 1 versions 3.2C through 5.1K Kelio Visio X7 versions 3.2C through 5.1K Kelio Visio X4 versions 3.2C through 5.1K Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability that could allow an attacker to execute ...

Kelio Visio cross-site scripting vulnerability

Kelio Visio is a networked touchscreen punch terminal from Kelio that can be used for a variety of tasks. A cross-site scripting vulnerability exists in Kelio Visio, which stems from a reflective cross-site scripting vulnerability caused by injecting malicious code into the username parameter of...

CVE-2024-46432

The Tenda W18E wireless router (version 16.01.0.8(1625) ) is vulnerable to an Incorrect Access Control flaw within the setQuickCfgWifiAndLogin function. A remote attacker can exploit this deficiency by sending a specially crafted HTTP POST request to bypass security restrictions. Successful explo...

CVE-2024-46437

The Tenda W18E wireless router, specifically version V16.01.0.8(1625) , contains a sensitive information disclosure vulnerability in its web management portal. An unauthenticated remote attacker can bypass authentication checks by sending a specially crafted HTTP POST request to the getQuickCfgWi...

CVE-2024-46437: Exposure of Sensitive Information to an Unauthorized Actor

A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.81625 web management portal allows an unauthenticated remote attacker to retrieve sensitive configuration information, including WiFi SSID, WiFi password, and base64-encoded administrator credentials, by sending a special...

CVE-2024-46437

A sensitive information disclosure vulnerability in the Tenda W18E V16.01.0.81625 web management portal allows an unauthenticated remote attacker to retrieve sensitive configuration information, including WiFi SSID, WiFi password, and base64-encoded administrator credentials, by sending a special...

CVE-2025-1108

Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of emails sent to reset the password. To exploit the vulnerability, the attacker must create a POST request by injecting malicious content into...

CVE-2025-1107

Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoi...

CVE-2025-1103

A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function setwifiblacklists of the file /goform/setwifiblacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereferenc...

CVE-2025-1103 D-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereference

A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function setwifiblacklists of the file /goform/setwifiblacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereferenc...

CVE-2025-1103

CVE-2025-1103 affects D-Link DIR-823X (versions 240126–240802). The vulnerability resides in the HTTP POST Request Handler: set_wifi_blacklists (/goform/set_wifi_blacklists). Manipulating the macList argument triggers a null pointer dereference, with remote exploitability and public disclosure. P...

CVE-2025-1103 D-Link DIR-823X HTTP POST Request set_wifi_blacklists null pointer dereference

A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function setwifiblacklists of the file /goform/setwifiblacklists of the component HTTP POST Request Handler. The manipulation of the argument macList leads to null pointer dereferenc...

CVE-2025-1107

Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoi...

CVE-2025-1108

CVE-2025-1108 affects Janto, versions prior to r12. The issue is an insufficient data authenticity verification vulnerability that lets an unauthenticated attacker modify the content of password-reset emails by sending a crafted POST request that injects malicious content into the Xml parameter a...

CVE-2025-1107

CVE-2025-1107 affects Janto prior to r12. The vulnerability enables an unauthenticated attacker to change another user’s password by sending a crafted POST to /public/cgi/Gateway.php, due to an unverified password-change feature. Impact is a total compromise of password integrity for affected acc...

CVE-2025-1107 Unverified password change vulnerability in Janto

Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password without knowing their current password. To exploit the vulnerability, the attacker must create a specific POST request and send it to the endpoi...

PT-2025-5973 · Janto · Janto

Name of the Vulnerable Software and Affected Versions: Janto versions prior to r12 Description: The issue concerns an insufficient data authenticity verification vulnerability. This vulnerability allows an unauthenticated attacker to modify the content of emails sent to reset the password. To...

Apache Kvrocks security vulnerabilities

Apache Kvrocks is a distributed key-value NoSQL database from the Apache USA Foundation. A security vulnerability exists in Apache Kvrocks version 2.11.0 and earlier, which stems from an undetected Host or POST in a REQ request, allowing valid HTTP requests to be processed as RESP requests, which...