EUVD-2022-0520

Malicious code in bioql PyPI...

EUVD-2022-40961

Malicious code in bioql PyPI...

EUVD-2023-48210

Malicious code in bioql PyPI...

EUVD-2023-53256

Malicious code in bioql PyPI...

EUVD-2022-6160

Malicious code in bioql PyPI...

mod_auth_openidc security update

An update is available for modauthopenidc. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an OpenID Connect authentication module for...

Tenda G3 DNS Forward Rule Store Buffer Overflow DoS

The vulnerability of the dnsforwardrulestore function in the Tenda G3 wireless access point’s microprogramming software is related to buffer overflows due to stack-based processing of the rules parameter. Exploiting this vulnerability can allow an attacker to cause service interruptions by sendin...

PT-2025-39870

CVE-2025-9648: HIGH Beware! CivetWeb library vulnerability CVE-2021-4582 can lead to DoS attacks. Attackers exploiting null byte in POST requests may exhaust CPU. Update to commit 782e189.cve,CVE-2025-9648,cybersecurity https://t.co/koJeq5FxM4 https://t.co/uZhbbft0GF...

Tenda AC21 strcpy() Code Execution

The vulnerability of the strcpy function in the microprogramming software for Tenda AC21 lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted POST request...

D-Link DIR-513 Router FormWPS DoS

The vulnerability of the formWPS function in the /goform/formWPS module of the D-Link DIR-513 router’s microprogramming software lies in the copying of buffers without checking the size of the input data during the processing of the webpage parameter. Exploiting this vulnerability allows a...

CVE-2025-57296

Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the subADBC0 helper function concatenates these user-supplied values into...

CVE-2025-40696

Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fullname', 'location' and 'message' parameters via POST at the endpoint '/ofrs/reporting.php'. This vulnerability could...

Denial of service when trying to parse malformed POST requests in aiohttp

...

T-INNOVA Deporsite 安全漏洞

T-INNOVA Deporsite is an application from T-INNOVA, Inc. A security vulnerability exists in T-INNOVA Deporsite that stems from a lack of authorization and could lead to the modification of other users' avatars via POST requests and the IdPersona and Foto parameters...

CVE-2025-40708

OpenAtlas v8.9.0 is affected by a Cross-Site Scripting (XSS) flaw triggered by insufficient validation of the name field in the POST /insert/event API. An attacker could craft queries to an authenticated user and potentially steal session cookie details. The issue is corroborated by multiple sour...

CVE-2025-40705 Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH

Cross-Site Scripting XSS vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage ACDH-CH, due to inadequate validation of user input when a POST request is sent. The vulnerabilities could allow a remote user to send specially crafted queries to an...

CVE-2024-13979 St. Joe ERP System SingleRowQueryConverter SQL Injection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

CVE-2024-13979

The St. Joe ERP system ("圣乔ERP系统") is vulnerable to a SQL injection flaw due to insufficient input sanitization when processing user-supplied data. Unauthenticated remote attackers can exploit this by sending crafted HTTP POST requests to the /login endpoint to execute arbitrary SQL commands. Suc...

CVE-2025-50977

A template injection vulnerability leading to reflected cross-site scripting XSS has been identified in version 1.7.1, requiring authenticated admin access for exploitation. The vulnerability exists in the 'r' parameter and allows attackers to inject malicious Angular expressions that execute...

CVE-2024-13980: Deserialization of Untrusted Data

H3C Intelligent Management Center IMC versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters,...