Comtech EF Data CDM-625 安全漏洞

The Comtech EF Data CDM-625 is a satellite modem from Comtech EF Data. A security vulnerability exists in the Comtech EF Data CDM-625 version v2.5.1 that stems from improper access control and could allow an attacker to change the administrator password and elevate privileges via a specially...

PT-2025-53595

Name of the Vulnerable Software and Affected Versions Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem version 2.5.1 Description A flaw in access control within the Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem firmware allows attackers to modify the Administrator passwor...

CVE-2025-67015

CVE-2025-67015 affects the Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1. Root cause is improper access control that lets an unauthenticated attacker modify the Administrator password and escalate privileges by sending a crafted POST to /Forms/admin_access_1. Im...

CVE-2025-67015

Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/adminaccess1...

CVE-2025-67015

Incorrect access control in Comtech EF Data CDM-625 / CDM-625A Advanced Satellite Modem with firmware v2.5.1 allows attackers to change the Administrator password and escalate privileges via sending a crafted POST request to /Forms/adminaccess1...

CVE-2019-25237

V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the user role parameter. Attackers can send a crafted HTTP POST request to the user management endpoint with 'userrolemod' set to integer value '...

CVE-2019-25237 V-SOL GPON/EPON OLT Platform 2.03 Privilege Escalation via User Role Parameter

V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the user role parameter. Attackers can send a crafted HTTP POST request to the user management endpoint with 'userrolemod' set to integer value '...

CVE-2019-25237 V-SOL GPON/EPON OLT Platform 2.03 Privilege Escalation via User Role Parameter

V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the user role parameter. Attackers can send a crafted HTTP POST request to the user management endpoint with 'userrolemod' set to integer value '...

EUVD-2023-60236

D-Link DSL-124 ME1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configuration endpoint to download a complete backup file containing...

CVE-2023-53974

D-Link DSL-124 ME1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configuration endpoint to download a complete backup file containing...

CVE-2021-47715

Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the addremoteschema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL...

CVE-2023-53964 SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Factory Reset Vulnerability

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass...

CVE-2023-53974 D-Link DSL-124 ME_1.00 Backup Configuration File Disclosure via Unauthenticated Request

D-Link DSL-124 ME1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configuration endpoint to download a complete backup file containing...

D-Link DSL-124 访问控制错误漏洞

The D-Link DSL-124 is an optical cat routing all-in-one from China AUO D-Link. An access control error vulnerability exists in the D-Link DSL-124 ME1.00 version, which stems from a configuration file disclosure issue that could allow an unauthenticated attacker to obtain router settings via a POS...

PT-2025-52711

Name of the Vulnerable Software and Affected Versions D-Link DSL-124 ME version 1.00 Description An unauthenticated attacker can retrieve router settings by sending a specific POST request. This allows access to a complete backup file containing sensitive network credentials and system...

CVE-2023-53948

Lilac-Reloaded for Nagios 2.0.8 contains a remote code execution vulnerability in the autodiscovery feature that allows attackers to inject arbitrary commands. Attackers can exploit the lack of input filtering in the nmapbinary parameter to execute a reverse shell by sending a crafted POST reques...

CVE-2025-58053 Galette has a privilege escalation vulnerability

Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue...

Galette 安全漏洞

Galette is a Galette open source membership management web application for non-profit organizations. A security vulnerability exists in Galette versions prior to 1.2.0, which stems from elevated privileges that can be granted through a spoofed POST request...

CVE-2023-53941 EasyPHP Webserver 14.1 Remote Code Execution

EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by injecting malicious payloads through the appservicecontrol parameter. Attackers can send POST requests to /index.php?zone=settings with crafted...

EUVD-2023-60216

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative...