CVE-2024-41795

The CVE concerns Siemens SENTRON 7KT PAC1260 Data Manager (All versions) whose web interface is vulnerable to CSRF, enabling an unauthenticated attacker to alter device settings by tricking an admin into a malicious link. Several connected sources corroborate that the vulnerability involves chang...

CVE-2024-41791

CVE-2024-41791 affects Siemens SENTRON 7KT PAC1260 Data Manager (all versions). The issue is an unauthenticated report-creation path in the device web interface, enabling an unauthenticated remote attacker to read or clear log files, reset the device, or modify the date/time. Connected advisories...

CVE-2025-3393 mrcen springboot-ucan-admin Personal Settings Interface index cross site scripting

A vulnerability was found in mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef35301545143509. It has been classified as problematic. This affects an unknown part of the file /ucan-admin/index of the component Personal Settings Interface. The manipulation leads to cross site scripting. ...

CVE-2025-3393

CVE-2025-3393 affects mrcen springboot-ucan-admin (up to commit 5f35162032cbe9288a04e429ef35301545143509) and targets the Personal Settings Interface index. The vulnerability enables cross-site scripting through manipulation of an unknown part of that interface, with remote initiation. The descri...

CVE-2025-3393 mrcen springboot-ucan-admin Personal Settings Interface index cross site scripting

A vulnerability was found in mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef35301545143509. It has been classified as problematic. This affects an unknown part of the file /ucan-admin/index of the component Personal Settings Interface. The manipulation leads to cross site scripting. ...

PT-2025-15313 · Unknown · Mrcen Springboot-Ucan-Admin

Name of the Vulnerable Software and Affected Versions: mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef35301545143509 Description: A vulnerability was found in the Personal Settings Interface component of mrcen springboot-ucan-admin, affecting an unknown part of the file...

SpringBoot-Ucan-Admin 安全漏洞

SpringBoot-Ucan-Admin is an RBAC3-based permission management system by mrcen individual developers. A security vulnerability exists in SpringBoot-Ucan-Admin that stems from improper handling of parameters in the Personal Settings interface, which could lead to cross-site scripting attacks...

CVE-2025-28403

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings...

WordPress Internal Link Optimiser plugin <= 5.1.2 - Settings Change vulnerability

Settings Change vulnerability discovered by Mika in WordPress Plugin Internal Link Optimiser versions = 5.1.2...

CVE-2025-3328

CVE-2025-3328 affects the Tenda AC1206 router (firmware 15.03.06.23). The issue is a buffer overflow in the function /goform/fast_setting_wifi_set (form_fast_setting_wifi_set) caused by unbounded input in the ssid and/or timeZone parameters. It can be triggered remotely over the network, with rep...

Tenda AC1206 缓冲区错误漏洞

Shenzhen Jixiang Tengda Technology Co., Ltd AC1206 is a high-performance wireless router designed for 200M and above broadband users. A buffer overflow vulnerability exists in the Shenzhen Jixiang Tengda Technology Company Limited AC1206. The vulnerability stems from the formfastsettingwifiset...

PT-2025-15244 · Ruoyi · Ruoyi

Name of the Vulnerable Software and Affected Versions: RUoYi version 4.8.0 Description: An issue in RUoYi allows a remote attacker to escalate privileges via the editSave method, which does not properly validate whether the requesting user has administrative privileges before allowing modificatio...

CVE-2025-28403

An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings...

CVE-2024-13898

The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output...

PT-2025-18032 · Totolink · Totolink N150Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N150RT version 3.4.0-B20190525 Description: A vulnerability was found in the LAN Settings Page component, specifically in the /boafrm/fromStaticDHCP file. The manipulation of the Hostname argument leads to cross-site scripting. The...

Updated corosync packages fix security vulnerability

Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orftokenendianconvert in exec/totemsrp.c via a large UDP packet. CVE-2025-30472...

CVE-2025-32269 WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms allows Cross Site Request Forgery. This issue affects WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through 1.1.3...

CVE-2025-32270 WordPress Broadstreet Plugin <= 1.51.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in Broadstreet Broadstreet allows Cross Site Request Forgery. This issue affects Broadstreet: from n/a through 1.51.1...

CVE-2025-32268

Technical details about CVE-2025-32268 are not publicly provided in the supplied documents. No confirmed affected products, versions, or fixes are disclosed here. Monitor for official advisories and updates.

CVE-2025-32241 WordPress Official CleverReach WooCommerce Integration Plugin <= 3.4.3 - CSRF to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in CleverReach® Official CleverReach Plugin for WooCommerce allows Cross Site Request Forgery. This issue affects Official CleverReach Plugin for WooCommerce: from n/a through 3.4.3...