CVE-2025-9821

The CVE-2025-9821 relates to Mautic’s webhook feature, where the destination of webhooks is not validated, enabling SSRF when a user with webhook permissions can view webhook logs. This can allow bypassing firewalls to reach internal services and may disclose partial response data. Exploitation d...

CVE-2025-9821 SSRF via webhook function

SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the partial request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal...

CVE-2025-9821 SSRF via webhook function

SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the partial request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal...

CVE-2025-9821 SSRF via webhook function

SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the partial request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal...

Linux Distros Unpatched Vulnerability : CVE-2016-8643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. CVE-2016-8643 Note that Nessus relies on the presence of the packa...

Linux Distros Unpatched Vulnerability : CVE-2020-25700

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5...

CVE-2025-9831

A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. This impacts an unknown function of the file /admin/edit-services.php. This manipulation of the argument sername causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2025-9831 PHPGurukul Beauty Parlour Management System edit-services.php sql injection

A weakness has been identified in PHPGurukul Beauty Parlour Management System 1.1. This impacts an unknown function of the file /admin/edit-services.php. This manipulation of the argument sername causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2025-9831

CVE-2025-9831 concerns PHPGurukul Beauty Parlour Management System 1.1. The vulnerability is a SQL injection in the file /admin/edit-services.php, caused by manipulation of the parameter named in the description as “sername.” The issue is exploitable remotely and public exploits exist, per multip...

CVE-2025-9830

A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-services.php. The manipulation of the argument sids results in sql injection. The attack can be executed remotely. The exploit has been released...

CVE-2025-9830

A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-services.php. The manipulation of the argument sids results in sql injection. The attack can be executed remotely. The exploit has been released...

CVE-2025-9830 PHPGurukul Beauty Parlour Management System add-customer-services.php sql injection

A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-services.php. The manipulation of the argument sids results in sql injection. The attack can be executed remotely. The exploit has been released...

CVE-2025-9830 PHPGurukul Beauty Parlour Management System add-customer-services.php sql injection

A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-services.php. The manipulation of the argument sids results in sql injection. The attack can be executed remotely. The exploit has been released...

CVE-2025-9830

CVE-2025-9830 affects PHPGurukul Beauty Parlour Management System 1.1. The vulnerability is a SQL injection in the file /admin/add-customer-services.php, triggered by manipulating the sids[] parameter. It is exploitable remotely and publicly available exploits exist. Reported by multiple sources ...

CVE-2025-52547

E3 Site Supervisor Control firmware version 2.31F01 MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services...

CVE-2025-52547

E3 Site Supervisor Control firmware version 2.31F01 MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services...

CVE-2025-52548

E3 Site Supervisor Control firmware version 2.31F01 contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the...

CVE-2025-52548 Enabling SSH and Shellinabox on the vulnerable machine

E3 Site Supervisor Control firmware version 2.31F01 contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the...

CVE-2025-52548 Enabling SSH and Shellinabox on the vulnerable machine

E3 Site Supervisor Control firmware version 2.31F01 contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the...

CVE-2025-52547 DoS to the application services

E3 Site Supervisor Control firmware version 2.31F01 MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services...