CVE-2025-13624

The Overstock Affiliate Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2025-60799

phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters 'subject', 'server', 'database', 'queryid' without proper validation or access...

EUVD-2011-5162

Malware in sbrugna...

EUVD-2020-2672

Malware in sbrugna...

CVE-2025-50976

IPFire 2.29 DNS management interface dns.cgi fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLSHOSTNAME query parameters, resulting in a reflected cross-site scripting XSS vulnerability...

CVE-2025-55603

The Tenda AX3 Wi-Fi router is vulnerable to a buffer overflow in the fromSetSysTime function (specifically the SetSysTimeCfg() function) within its microprogramming software. The root cause is the failure to validate the length and size of input data when processing the ntpServer parameter. A rem...

Tenda AC6 安全漏洞

Tenda AC6 is a dual-band wireless router from Tenda that supports IPv4 and IPv6 protocols and utilizes the 802.11ac/n wireless standard to provide a wireless transmission rate of 1167Mbps. Tenda AC6 suffers from a buffer overflow vulnerability that originates from the ntpServer parameter in the...

CVE-2025-55499

Tenda AC6 V15.03.06.23multi was discovered to contain a buffer overflow via the ntpServer parameter in the fromSetSysTime function...

CVE-2025-55499

The Tenda AC6 dual-band wireless router, specifically version V15.03.06.23_multi , is vulnerable to a buffer overflow via the ntpServer parameter in the fromSetSysTime function. The root cause is the copying of buffers without verifying the input data size. A remote attacker could exploit this vu...

The vulnerability of the httpGetEnv() function in TP-Link TL-WR940N router software allows a hacker to cause a service failure.

The vulnerability of the httpGetEnv function in TP-Link TL-WR940N router software lies in the fact that the operation is executed outside the buffer in memory when processing the dnsserver1 parameter. Exploiting this vulnerability allows a malicious actor to cause service failure by sending a...

CVE-2025-3594

Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to 1 add files to arbitrary locations on the server and 2 download and...

CVE-2024-30572

Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntpserver parameter...

CVE-2024-11253

A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50ABOM.8.5C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a...

ZZCMS 安全漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS version 2025, which stems from the lack of effective filtering and escaping of user-supplied data by the parameter $SERVER PHPSELF , and can be exploited by an attacker to...

CVE-2024-57590

TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntpsync.cgi",which allows remote attackers to execute arbitrary commands via parameter "ntpserver" passed to the "ntpsync.cgi" binary through a POST request...

PT-2025-3479 · Trendnet · Trendnet Tew-632Brp

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-632BRP version 1.010B31 Description: The issue is related to an OS command injection vulnerability in the CGl interface "ntp sync.cgi". This vulnerability allows remote attackers to execute arbitrary commands via the ntp server...

CVE-2024-12047

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘customserver’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2025-1737 · WordPress · Wp Compress

Name of the Vulnerable Software and Affected Versions: WP Compress – Instant Performance & Speed Optimization plugin for WordPress versions up to, and including, 6.30.03 Description: The issue is related to Reflected Cross-Site Scripting via the custom server parameter due to insufficient input...

CVE-2024-51188

TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting XSS vulnerability via the vsRuleVirtualServerName1.1.10.0.0 parameter on the /virtualserver.htm page...

CVE-2024-50996

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the bpaserver parameter at geniebpa.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...