CVE-2024-58275 Easywall 0.3.1 - Authentication Bypass via Command Injection in /ports-save Endpoint

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server...

CVE-2024-58275 Easywall 0.3.1 - Authentication Bypass via Command Injection in /ports-save Endpoint

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server...

Easywall 参数注入漏洞

Easywall is a jpylypiw open source firewall software. A parameter injection vulnerability exists in Easywall version 0.3.1, which stems from a command injection in the /ports-save endpoint that could lead to the execution of arbitrary commands...

CVE-2024-58275: Improper Neutralization of Argument Delimiters in a Command

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw. Attackers can inject shell metacharacters to execute arbitrary commands on the server...

PT-2025-49205

Name of the Vulnerable Software and Affected Versions Webcake – Landing Page Builder plugin for WordPress versions prior to 1.2 Description The Webcake – Landing Page Builder plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check on the...

PT-2025-49131

Name of the Vulnerable Software and Affected Versions Easywall version 0.3.1 Description The software contains a flaw that permits authenticated remote command execution. This is due to a parameter injection weakness in the /ports-save API endpoint, allowing attackers to inject shell metacharacte...

CVE-2025-13342

The CVE-2025-13342 flaw affects the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.28.20). Root cause: ActionOptions::run() save handler lacks proper capability checks and input validation, allowing unauthenticated users to modify WordPress options (e.g., users_can_...

The vulnerability of the _kvm_save_timer() function in the arch/loongarch/kvm/timer.c file, which is part of the LoongArch architecture support for the Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the kvmsavetimer function in the arch/loongarch/kvm/timer.c module, which is part of the LoongArch architecture support for the Linux operating system, is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to...

EUVD-2025-199809

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ayschatgptsavewpmedia' function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload...

The vulnerability of the httpd-demon (/goform/saveParentControlInfo) in the Tenda AC21 router microprogramming software allows a intruder to trigger a service failure.

The vulnerability of the httpd-demon /goform/saveParentControlInfo of the Tenda AC21 router’s microprogramming system is related to the execution of operations outside the buffer in memory when processing the urls parameter. Exploiting this vulnerability allows a malicious actor to cause service...

📄 Craft CMS 5.0 Authentication Session Path Exposure

Proof of concept exploit that demonstrates an authentication session path exposure vulnerability in Craft CMS version 5.0. ============================================================================================================================================= | Title : Craft CMS 5.0...

[SECURITY] Fedora 42 Update: buildah-1.42.1-1.fc42

The buildah package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a ne...

EUVD-2025-198404

The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uipsavesiteoption function in all versions up to, and including, 3.5.08. This makes it possible for authenticate...

EUVD-2025-198406

The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csscode' parameter in all versions up to, and including, 1.0.6 due to a missing capability check on the savecustomecode function. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-12135

The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csscode' parameter in all versions up to, and including, 1.0.6 due to a missing capability check on the savecustomecode function. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-11003

The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uipsaveuitemplate' function in all versions up to, and including, 3.5.09. This makes it possible for...

CVE-2025-11773 Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authorization to Authenticated (Subscriber+) Contract Address Update

The Cryptocurrency Token, Launchpad Presale, ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveDeployedContract' function in all versions up to, and including, 2.4.7. This makes it possible for...

CVE-2025-11815 UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uipsavesiteoption function in all versions up to, and including, 3.5.08. This makes it possible for authenticate...

PT-2025-47691

Name of the Vulnerable Software and Affected Versions WPBookit versions up to and including 1.0.6 Description The WPBookit plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to a missing capability check on the save custome code function, allowing unauthenticated...

PT-2025-47687

The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip save site option function in all versions up to, and including, 3.5.08. This makes it possible for...