Linux Distros Unpatched Vulnerability : CVE-2026-22030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router or Remix v2 is...

CVE-2026-22030 React Router has CSRF issue in Action/Server Action Request Processing

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router or Remix v2 is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when...

react-router 跨站请求伪造漏洞

react-router is a Remix open source declarative routing for React. A cross-site request forgery vulnerability exists in react-router version 7.11.0 and earlier, which stems from the vulnerability to a cross-site request forgery attack against document POST requests when using a server-side route...

CVE-2026-22030: Origin Validation Error

React Router is a router for React. In @remix-run/server-runtime version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, React Router or Remix v2 is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework Mode, or when...

CVE-2023-43847

Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to control all the outlets as if they were the administrator via HTTP POST requests...

CVE-2023-50248

CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-craft...

PT-2026-2140

Name of the Vulnerable Software and Affected Versions Snuffleupagus versions prior to 0.13.0 Description Snuffleupagus is a module designed to increase the cost of attacks against websites by eliminating bug classes and offering a virtual patching system. In deployments of Snuffleupagus before...

CVE-2019-25270

SOCA Access Control System 180612 is affected by a reflected XSS in the senddata POST parameter of logged_page.php (also referred to as logged page.php in PT-2026-1674). The root cause is improper handling/encoding of user-supplied data, allowing attackers to inject and execute arbitrary HTML/scr...

CVE-2019-16261

Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changing the manager or admin password, or shutting off power to an outlet. NOTE: the vendor's position is that a newer firmware version, fixing this...

CVE-2019-25270: Improper Neutralization of Input During Web Page Generation

SOCA Access Control System 180612 contains a cross-site scripting vulnerability in the 'senddata' POST parameter of loggedpage.php that allows attackers to inject malicious scripts. Attackers can exploit this weakness by sending crafted POST requests to execute arbitrary HTML and script code in a...

Tenda AC10U Code Execution

The vulnerability of the formSetPPTPUserList function in the Tenda AC10U router’s microprogramming software is related to the copying of buffers without checking the size of the input data when processing the list parameter. Exploiting this vulnerability allows a remote attacker to execute...

PT-2025-54243

Name of the Vulnerable Software and Affected Versions SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and earlier Description The software contains a conditional command injection issue. Local authenticated users can create malicious files in the /tmp directory. Unauthenticated attackers can execute...

Wavlink NU516U1 Sub Function Arbitrary Command Execution

The vulnerability of function sub401778 in the microprogrammed Wavlink NU516U1 router software is related to the lack of measures taken to clean data at the control level when processing the argument dmzflagt. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

Wavlink NU516U1 DeleteMac Component Sub_402D1C Arbitrary Command Execution

The vulnerability of component DeleteMac Page’s sub402D1C function in the Wavlink NU516U1 microprogramming system lies in the failure to take data cleaning measures at the control level when processing the deletelist argument. Exploiting this vulnerability allows an attacker to execute arbitrary...

Wavlink NU516U1 Arbitrary Command Execution

The vulnerability of sub4016F0 in the microprogrammed Wavlink NU516U1 router software is related to the failure to take measures for data cleaning at the control level when processing the delflag argument. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands via PO...

Wavlink NU516U1 Delete_Mac_list Arbitrary Command Execution

The vulnerability of the DeleteMaclist component of the sub4030C0 function in the Wavlink NU516U1 microprogramming system lies in the failure to take data cleaning measures at the control level when processing the deletelist argument. Exploiting this vulnerability allows an attacker to execute...

CVE-2018-25134

Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticated attackers to create admin user accounts. Attackers can exploit the missing control check by sending crafted POST requests to create administrative account...

PT-2025-53364

Name of the Vulnerable Software and Affected Versions Microhard Systems IPn4G version 1.1.0 Description The software contains an authentication bypass that allows authorized attackers to read, modify, or delete arbitrary files. The issue resides in the hidden system-editor.sh script. Attackers ca...

PT-2025-54718

Mattermost versions 11.1.x = 11.1.0, 11.0.x = 11.0.5, 10.12.x = 10.12.3, 10.11.x = 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions =4.4.0 fail to enforce authentication and issue-key path restrictions in the Jira plugin, which allows an unauthenticated attacker who knows ...

PT-2025-52492

Name of the Vulnerable Software and Affected Versions Galette versions prior to 1.2.0 Description Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, it was possible to gain higher privileges by updating an existing account using a self-forged...