33428 matches found
Shenzhen Aitemi M300 Wi-Fi Repeater – Unauthenticated Remote Command Execution via `time` Parameter
An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike othe...
CVE-2026-20985
Samsung Members app (versions before 5.6.00.11) contains an input validation flaw that allows remote attackers to connect arbitrary URLs and launch arbitrary activities with Samsung Members privileges. Trigger requires user interaction. Impact is elevated privileges within the Samsung Members con...
F5 BIG-IP Edge Client 信息泄露漏洞
F5 BIG-IP Edge Client is a security remote access client software developed by F5 Corporation in the United States. The F5 BIG-IP Edge Client has a vulnerability related to information leakage, which may allow attackers to access sensitive data...
PT-2026-6358
Impact On boot, Pillar checks for /config/GlobalConfig/global.json and overrides system configuration if present. This allows enabling debug functions like SSH debug.enable.ssh, USB keyboard debug.enable.usb, and VNC access app.allow.vnc without triggering the measured boot. Thus, a user with...
CVE-2020-37083
PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' parameter. Attackers can inject crafted SQL statements with time delays to extract information by observing response times in the photo.php...
CVE-2020-37086 Easy Transfer 1.7 for iOS - Directory Traversal
Easy Transfer 1.7 iOS mobile application contains a directory traversal vulnerability that allows remote attackers to access unauthorized file system paths without authentication. Attackers can exploit the vulnerability by manipulating path parameters in GET and POST requests to list or download...
CVE-2020-37086
CVE-2020-37086 affects Easy Transfer 1.7 for iOS. A directory-traversal vulnerability allows unauthenticated attackers to access unauthorized file-system paths by manipulating path parameters in GET/POST requests, enabling listing/downloading sensitive files and injecting scripts into application...
CVE-2025-57529
YouDataSum CPAS Audit Management System =v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation. This allows remote unauthenticated attackers to execute arbitrary SQL commands via crafted input to the parameter. Successful exploitation could...
CVE-2020-37116 GUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote Access
GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to obtain the MySQL password, leading to full database compromise...
CVE-2020-37116
GUnet OpenEclass 1.7.3 ships with phpMyAdmin 2.10.0.2 by default, enabling remote login. If an attacker gains platform access, they can reach phpMyAdmin, upload a shell, and view the config.php to obtain the MySQL password, enabling full database compromise. The provided documents do not specify ...
CVE-2025-67480
A flaw was found in MediaWiki. This vulnerability, associated with the ApiQueryRevisionsBase.Php program file, could be exploited by a remote attacker with low privileges. However, based on the provided CVSS v4 score, this flaw does not have a direct security impact on the confidentiality,...
Synectix LAN 232 TRIO
RISK EVALUATION Successful exploitation of this vulnerability could result in an unauthenticated attacker modifying critical device settings or factory resetting the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...
CVE-2026-1734
A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file crmeb/app/api/controller/v1/CrontabController.php of the component crontab Endpoint. The manipulation results in missing authorization. The attack can be launched remotely. The...
CVE-2025-58382
A vulnerability in the secure configuration of authentication and management services in Brocade Fabric OS before Fabric OS 9.2.1c2 could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands as root using “supportsave”, “seccertmgmt”, “configupload...
EUVD-2025-206762
A vulnerability in the secure configuration of authentication and management services in Brocade Fabric OS before Fabric OS 9.2.1c2 could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands as root using “supportsave”, “seccertmgmt”, “configupload...
PT-2026-5978
Name of the Vulnerable Software and Affected Versions FUXA version 1.2.7 Description The software initializes with authentication disabled due to the 'secureEnabled' flag being commented out in the 'server/settings.default.js' file. This allows unauthenticated remote attackers to access sensitive...
Linux Distros Unpatched Vulnerability : CVE-2026-21925
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: RMI. Supported versions that...
Linux Distros Unpatched Vulnerability : CVE-2026-21933
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versio...
EndRun Technologies Sonoma OS Command Injection (CVE-2025-60964)
OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, gain sensitive information, and possibly other unspecified impacts. This plugin...
