PT-2025-3829

Name of the Vulnerable Software and Affected Versions YunzMall versions up to 2.4.2 Description A critical issue has been found in the function changePwd of the file /app/platform/controllers/ResetpwdController.php of the component HTTP POST Request Handler. The manipulation of the argument pwd...

CVE-2024-13200: Improper Access Control

A vulnerability, which was classified as critical, was found in wander-chu SpringBoot-Blog 1.0. This affects the function preHandle of the file src/main/java/com/my/blog/website/interceptor/BaseInterceptor.java of the component HTTP POST Request Handler. The manipulation leads to improper access...

CVE-2025-0328: Improper Neutralization of Special Elements used in a Command

A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality of the file /public/server/runCode.php of the component HTTP POST Request Handler. The manipulation of the argument code leads to command...

CVE-2025-0331: Weak Password Recovery Mechanism for Forgotten Password

A vulnerability, which was classified as critical, has been found in YunzMall up to 2.4.2. This issue affects the function changePwd of the file /app/platform/controllers/ResetpwdController.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to weak password...

CVE-2025-22137

Pingvin Share is a self-hosted file sharing platform and an alternative for WeTransfer. This vulnerability allows an authenticated or unauthenticated if anonymous shares are allowed user to overwrite arbitrary files on the server, including sensitive system files, via HTTP POST requests. The issu...

SiYuan has an arbitrary file deletion vulnerability

Summary A arbitrary file deletion vulnerability has been identified in the latest version of Siyuan Note. The vulnerability exists in the POST /api/history/getDocHistoryContent endpoint.An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on...

PT-2025-3535 · D Link · D-Link 816

Name of the Vulnerable Software and Affected Versions: D-Link 816A2 FWv1.10CNB05 R1B011D88210 Description: An access control issue in the component form2Wan.cgi of D-Link devices allows unauthenticated attackers to configure the WAN service of the device via a crafted POST request to the...

PT-2025-3474 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version V15.03.05.19 Description: The issue is related to a stack overflow in the formSetClientState function when handling the limitSpeedUp parameter. This can be exploited by a remote attacker to cause a denial of service or...

CVE-2021-26102

A relative path traversal vulnerability CWE-23 in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to...

CVE-2021-26102: Authentication Bypass by Primary Weakness

A relative path traversal vulnerability CWE-23 in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-aiohttp (SUSE-SU-2024:4327-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:4327-1 advisory. - CVE-2024-30251: Fixed infinite loop on specially crafted POST request bsc1223726. Tenable has extracted...

CVE-2024-29671

Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2024-30251: Fixed infinite loop on specially crafted POST request bsc1223726. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...

SUSE-SU-2024:4328-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2024-30251: Fixed infinite loop on specially crafted POST request bsc1223726...

SUSE-SU-2024:4327-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2024-30251: Fixed infinite loop on specially crafted POST request bsc1223726...

PT-2024-22958

Name of the Vulnerable Software and Affected Versions NEXTU FLATA AX1500 Router version 1.0.2 Description The issue is a buffer overflow vulnerability that allows a remote attacker to execute arbitrary code via the POST request handler component. This enables the attacker to run any code they wan...

NEXTU FLATA AX1500 security vulnerability

The NEXTU FLATA AX1500 is a wireless router from NEXTU. A security vulnerability exists in the NEXTU FLATA AX1500 version v.1.0.2, which stems from the presence of a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code via the POST request handler component...

CVE-2024-29671: Buffer Copy without Checking Size of Input

Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component...

PT-2024-41430

Уязвимость SCADA-системы Пульт.онлайн связана с несоответствием ответов на входящие запросы. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации путём отправки специально сформированного POST-запроса...

CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...