CVE-2025-3659 Improper authentication handling for Digi PortServer TS; Digi One SP, SP IA, IA; Digi One IAP

Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: Digi PortServer TS - prior to and including 82000747AA, build date 06/17/2022 Digi One SP/Digi One SP IA/Digi One IA - prior to and including 82000774Z, build date 10/19/2020...

TOTOLINK A720R Router cstecgi.cgi Privilege Escalation

The vulnerability of the cstecgi.cgi /cgi-bin/cstecgi.cgi script in the TOTOLINK A720R router software is related to errors in access control when processing the topicurl parameter. Exploiting this vulnerability allows a remote attacker to increase their privileges by sending specially crafted PO...

PARTS SOFT CMS CSRF

The vulnerability of PARTS SOFT’s CMS is related to insufficient verification of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack by sending a specially crafted POST request...

SUSE-SU-2025:1465-1 Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issues: - CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data. bsc1240893...

mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

Tenda FH1202 Privilege Escalation

The vulnerability of the web-based management interface for Tenda FH1202 micro-programmed routing software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges by sending specially crafted POST requests...

mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

RHEL 8 : mod_auth_openidc:2.3 (RHSA-2025:4192)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4192 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connec...

mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

Tenda W20E formSetStaticRoute Code Execution

The vulnerability of the formSetStaticRoute function in the Tenda W20E wireless Wi-Fi router software lies in the reading of data beyond the buffer in memory during the processing of parameters such as staticRouteNet, staticRouteMask, staticRouteGateway, and staticRouteWAN. Exploiting this...

Fedora 41 : mod_auth_openidc (2025-7d661758bd)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-7d661758bd advisory. REbase modauthopenidc-2.4.16.11 resolves CVE-2025-31492 - modauthopenidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data Tenable has...

mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

Websoft HCM Automation Software XSS

The vulnerability of Websoft HCM’s automation software for HR processes is related to insufficient verification of entered data. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code by sending a specially crafted POST request...

DEBIAN-CVE-2025-31492

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a modauthopenidc results in disclosure of protected content to unauthenticated users. The...

TRENDnet TEW-410APB DoS

The vulnerability of the HTTP request processor in TRENDnet TEW-410APB wireless access points is related to the zero pointer swapping issue. Exploiting this vulnerability allows a remote attacker to cause service interruptions by sending a specially crafted POST request...

GHSA-2Q39-W2HW-2PJM Infinispan Potential Out of Memory Error via REST Compare API Buffer API

A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the REST API...

CVE-2025-2597 Reflected Cross-Site Scripting (XSS) vulnerability in ITIUM 6050

Reflected Cross-Site Scripting XSS in ITIUM 6050 version 5.5.5.2-b3526 from Impact Technologies. This vulnerability could allow an attacker to execute malicious Javascript code via GET and POST requests to the ‘/index.php’ endpoint and injecting code into the ‘idsession...

CVE-2025-2597

CVE-2025-2597 describes a reflected Cross-Site Scripting (XSS) vulnerability in Impact Technologies ITIUM 6050 (version 5.5.5.2-b3526 ). According to the sources, an attacker could execute arbitrary JavaScript by crafting GET/POST requests to the endpoint /index.php and injecting code via the par...