17318 matches found
CVE-2025-7689
The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhbresetpasswordcallback function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password o...
Sielox AnyWare 安全漏洞
Sielox AnyWare is an access control system from Sielox USA. A security vulnerability exists in Sielox AnyWare version v2.1.2, which stems from an unvalidated email address field in the password reset form, which could lead to SQL injection...
PT-2025-31557 · Sielox · Sielox Anyware
Name of the Vulnerable Software and Affected Versions: Sielox AnyWare version 2.1.2 Description: The software contains a SQL injection issue via the email address field of the password reset form. Recommendations: Apply input validation and sanitization to the email address field in the password...
CVE-2024-34327
Sielox AnyWare v2.1.2 is affected by CVE-2024-34327, a SQL injection through the email field in the password-reset form. The connected exploit document provides a time-based blind PoC targeting the POST endpoint /auth/password-reset-token.php, using the email parameter and a SLEEP() payload to de...
CVE-2024-34327
Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form...
Güralp FMUS 访问控制错误漏洞
The Güralp FMUS is a seismic monitoring device from Güralp UK. An access control error vulnerability exists in the Güralp FMUS that originates from an unauthenticated Telnet command line interface and could result in modifying the hardware configuration or restoring factory settings...
(Pwn2Own) QNAP TS-464 reset_password.cgi Improper Certificate Validation Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of QNAP TS-464 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetpassword.cgi endpoint. The issue results from the lack of...
Linksys WRT120N 安全漏洞
Linksys WRT120N is a router from Linksys, Inc. A security vulnerability exists in the Linksys WRT120N that stems from improper endpoint boundary checking in tmUnblock.cgi, which could lead to a stack buffer overflow and password reset...
CVE-2024-34327
Sielox AnyWare v2.1.2 was discovered to contain a SQL injection vulnerability via the email address field of the password reset form...
(Pwn2Own) QNAP QHora-322 local_pwd_reset HTTP Request Smuggling Vulnerability
This vulnerability allows network-adjacent attackers to smuggle arbitrary HTTP requests on affected installations of QNAP QHora-322 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...
SUSE CVE-2025-38417
In the Linux kernel, the following vulnerability has been resolved: ice: fix eswitch code memory leak in reset scenario Add simple eswitch mode checker in attaching VF procedure and allocate required port representor memory structures only in switchdev mode. The reset flows triggers VF if present...
CVE-2025-54535
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms...
CVE-2025-1221
A Zigbee Radio Co-Processor RCP, which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host system CPCd due to heavy Zigbee traffic, resulting in a Denial of Service DoS attack, Only hard reset will bring the device to normal operation...
CVE-2025-1221 DoS in Zigbee device due to heavy traffic
A Zigbee Radio Co-Processor RCP, which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host system CPCd due to heavy Zigbee traffic, resulting in a Denial of Service DoS attack, Only hard reset will bring the device to normal operation...
CVE-2025-1221
CVE-2025-1221 affects Zigbee Radio Co-Processors using Silicon Labs EmberZNet Zigbee stack. The issue arises from heavy Zigbee traffic that prevents messages from being sent to the host system (CPCd), causing a Denial of Service. Practical impact is DoS with normal operation only restored by a ha...
CVE-2025-1221 DoS in Zigbee device due to heavy traffic
A Zigbee Radio Co-Processor RCP, which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host system CPCd due to heavy Zigbee traffic, resulting in a Denial of Service DoS attack, Only hard reset will bring the device to normal operation...
WordPress Dataverse Integration Missing Authorization Vulnerability
WordPress Dataverse Integration is a plugin mainly used to connect WordPress with Dataverse to achieve two-way data synchronization and business application integration. WordPress Dataverse Integration suffers from a lack of authorization vulnerability, which stems from a lack of authorization...
PT-2025-31377 · Silicon · Ember Znet
Name of the Vulnerable Software and Affected Versions: SiLabs EmberZNet Zigbee stack affected versions not specified Description: A Zigbee Radio Co-Processor RCP using the SiLabs EmberZNet Zigbee stack was unable to send messages to the host system CPCd due to heavy Zigbee traffic. This resulted ...
SUSE CVE-2025-38371
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Disable interrupts before resetting the GPU Currently, an interrupt can be triggered during a GPU reset, which can lead to GPU hangs and NULL pointer dereference in an interrupt context as shown in the following trace:...
