CVE-2025-65075

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete files, with the permissions of dvr user, on the server using path traversal in the alog script. This iss...

CVE-2025-65074

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version...

CVE-2025-65074

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version...

CVE-2025-65076 Arbitrary File Read and Delete via Path Traversal in WaveStore Server

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete any file on the server using path traversal in the ilog script. This script is being run with root...

CVE-2025-65076

Summary: CVE-2025-65076 affects the WaveView client. A path traversal flaw in the ilog script, executed with root privileges on the WaveStore Server, allows a high-privilege attacker to read or delete arbitrary server files. Affected components (from provided sources): WaveView client interfacing...

CVE-2025-65075 Arbitrary File Read and Delete via Path Traversal in WaveStore Server

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete files, with the permissions of dvr user, on the server using path traversal in the alog script. This iss...

CVE-2025-65075 Arbitrary File Read and Delete via Path Traversal in WaveStore Server

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to read or delete files, with the permissions of dvr user, on the server using path traversal in the alog script. This iss...

CVE-2025-65075

Summary: CVE-2025-65075/65074/65076 pertains to the WaveView client exposing path-traversal vulnerabilities in WaveStore Server commands/scripts. Public reports describe arbitrary file read/delete via path traversal in specific server-side scripts (alog, showerr, ilog) executed with high/root pri...

CVE-2025-65074

WaveView client/vulnerable component is WaveStore Server interaction. CVE-2025-65074 describes path traversal in the showerr script that lets a high-privileged attacker execute arbitrary OS commands on the server. Affected: WaveView client with WaveStore Server via showerr; impact is remote comma...

CVE-2025-65074 OS Command Injection via Path Traversal in WaveStore Server

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version...

CVE-2025-65074 OS Command Injection via Path Traversal in WaveStore Server

WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-privileges is able to execute arbitrary OS commands on the server using path traversal in the showerr script. This issue was fixed in version...

EUVD-2025-203540

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeNectar Salient Portfolio salient-portfolio allows Stored XSS.This issue affects Salient Portfolio: from n/a through = 1.8.2...

EUVD-2025-203594

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in colabrio Norebro Extra norebro-extra allows Code Injection.This issue affects Norebro Extra: from n/a through = 1.6.8...

CVE-2025-64633

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in colabrio Norebro Extra norebro-extra allows Code Injection.This issue affects Norebro Extra: from n/a through = 1.6.8...

CVE-2025-64633 WordPress Norebro Extra plugin <= 1.6.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in colabrio Norebro Extra norebro-extra allows Code Injection.This issue affects Norebro Extra: from n/a through = 1.6.8...

EUVD-2025-203473

Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods...

CVE-2025-58173

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the...

Linksys E5600 安全漏洞

Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys, Inc. A security vulnerability exists in Linksys E5600 version V1.1.0.26, which originates from stored cross-site scripting in the pagesave component and could lead to arbitrary web script execution...

Wave Terminal 路径遍历漏洞

Wave Terminal is an enterprise collaboration system from the Wave Terminal open source. A path traversal vulnerability exists in Wave Terminal, which stems from a path traversal in the alog script that could result in reading or deleting files...

PT-2025-51404

Name of the Vulnerable Software and Affected Versions colabrio Norebro Extra versions through 1.6.8 Description The software contains an Improper Neutralization of Script-Related HTML Tags in a Web Page issue, which can lead to Code Injection. The issue is a Basic Cross-Site Scripting XSS...