1690 matches found
PT-2025-34241 · Laravel +1 · Laravel +1
Name of the Vulnerable Software and Affected Versions: UnoPim versions prior to 0.2.1 Description: UnoPim, an open-source Product Information Management PIM system built on the Laravel framework, is susceptible to Cross-Site Request Forgery CSRF attacks. Certain endpoints lack appropriate CSRF...
Deserialization Of Untrusted Data
prestashop/prestashop is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to improper handling in the getHeaders function, which allows an attacker to execute arbitrary code via a crafted POST request...
CVE-2025-53631: Improper Neutralization of Input During Web Page Generation
flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads to arbitrary JavaScript execution XSS on all pages the post is reflected on including /, /post/ID, /admin/posts, and /user/ID of the user...
Linksys Router Code Execution
The vulnerability of the setWan function in Linksys RE6250, RE6300, RE6350, RE6500, RE7000, and RE9000 routers is related to the execution of operations outside of the buffer in memory when processing the staticIp parameter. Exploiting this vulnerability allows an attacker to execute arbitrary co...
Netgear DGN1000B Router Command Execution
The vulnerability in the setup.cgi script of Netgear DGN1000B router microprogramming software relates to the failure to take measures to neutralize special elements used in the operating system’s command for handling the TimeToLive parameter. Exploiting this vulnerability allows a remote attacke...
CVE-2012-10028 Netwin SurgeFTP <= v23c8 Authenticated RCE
Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to surgeftpmgr.cgi. This can lead to full remote code execution on the underlying system...
PT-2025-31980 · Netwin · Surgeftp
Name of the Vulnerable Software and Affected Versions: Netwin SurgeFTP versions 23c8 and earlier Description: Netwin SurgeFTP contains a flaw in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to the surgeftpmgr.c...
NetWin Netwin SurgeFTP 安全漏洞
NetWin Netwin SurgeFTP is a multi-platform FTP server software from NetWin New Zealand. A security vulnerability exists in NetWin Netwin SurgeFTP version 23c8 and prior versions, which stems from an improper handling of POST requests and could lead to remote command execution...
Directory Traversal
Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Directory Traversal via the addcrypted endpoint when processing the package parameter. An attacker can achieve arbitrary file write and execute malicious co...
D-Link DIR-619L Router Form Set WAN XSS
The vulnerability of the formAdvanceSetup function /goform/formAdvanceSetup of the D-Link DIR-619L router’s microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...
CVE-2013-10035
A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPageAjax.php, and casesSchedulerGetPlugins.php, by supplying...
Tenda AX1803 formSetIptv Heap Buffer Overflow DoS
The vulnerability of the formSetIptv function in the microprogramming software for the Tenda AX1803 router is related to buffer overflows in the stack during the processing of the adv.iptv.stballvlans parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a...
MB CONNECT LINE mbNET.mini Resource Management Error Vulnerability
The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. MB CONNECT LINE mbNET.mini suffers from a resource management error vulnerability that originates from exhausting critic...
CVE-2025-41673
A high privileged remote attacker can execute arbitrary system commands via POST requests in the sendsms action due to improper neutralization of special elements used in an OS command...
CVE-2025-41676
A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession...
CVE-2025-41677
A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession...
CVE-2025-41681
A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...
CVE-2025-41681
A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...
CVE-2025-41674
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...