CVE-2025-65229

A stored cross-site scripting XSS vulnerability exists in the web interface of Lyrion Music Server = 9.0.3. An authenticated user with access to Settings Player can save arbitrary HTML/JavaScript in the Player name field. That value is stored by the server and later rendered without proper output...

CVE-2025-65672

Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows unauthorized share and invite access to course settings...

EUVD-2019-10551

Malware in sbrugna...

EUVD-2017-11846

Malware in sbrugna...

EUVD-2017-6433

Malware in sbrugna...

EUVD-2020-10589

Malware in sbrugna...

EUVD-2024-33031

Malicious code in bioql PyPI...

EUVD-2024-16162

Malicious code in bioql PyPI...

CVE-2025-55626

An Insecure Direct Object Reference IDOR vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 allows unauthorized attackers to access the Admin-only settings and edit the session storage...

CVE-2025-55626

The CVE-2025-55626 entry concerns Reolink Smart 2K+ Plug-in Wi‑Fi Video Doorbell with Chime, firmware 3.0.0.4662_2503122283. The vulnerability is an Insecure Direct Object Reference (IDOR) that allows unauthorized access to Admin-only settings and the ability to edit session storage. Root cause i...

CVE-2025-55626

An Insecure Direct Object Reference IDOR vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.46622503122283 allows unauthorized attackers to access the Admin-only settings and edit the session storage...

CVE-2023-21411

User provided input is not sanitized in the “Settings Access Control” configuration interface allowing for arbitrary code execution...

CVE-2025-4975

When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device...

CVE-2018-20851

Helpy before 2.2.0 allows agents to edit admins...

CVE-2017-15236

Tiandy IP cameras 5.56.17.120 do not properly restrict a certain proprietary protocol, which allows remote attackers to read settings via a crafted request to TCP port 3001, as demonstrated by config files and extendword.txt...

TP-LINK Tapo 安全漏洞

TP-LINK Tapo is a series of secure WiFi cameras from China P&L TP-LINK. A security vulnerability exists in TP-LINK Tapo versions prior to 3.10.513, which stems from a low battery notification that could lead to a user of a shared device gaining full power settings access...

PT-2025-21523 · WordPress · Everest Forms

Name of the Vulnerable Software and Affected Versions: Everest Forms versions prior to 3.0.3.1 Description: The issue concerns the Everest Forms WordPress plugin, where it fails to properly sanitize and escape some of its settings. This could allow high-privilege users, such as administrators, to...

CVE-2025-20956

Improper export of android application components in Settings in Galaxy Watch prior to SMR May-2025 Release 1 allows physical attackers to access developer settings...

SAMSUNG SMR 安全漏洞

SAMSUNG SMR is a system patch package from the South Korean company Samsung SAMSUNG. It provides patches for Samsung mobile applications. SAMSUNG SMR suffers from a security vulnerability that stems from improper export of Android application components in Settings, which could lead to a physical...

PT-2025-20041 · Samsung · Galaxy Watch

Name of the Vulnerable Software and Affected Versions: Galaxy Watch versions prior to SMR May-2025 Release 1 Description: The issue concerns the improper export of Android application components in the Settings of the Galaxy Watch, allowing physical attackers to access developer settings...