CVE-2026-66671: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...

CVE-2025-58902: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Lighthouse = 1.2.12 versions...

CVE-2025-60085: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Learnify = 1.15.0 versions...

CVE-2025-69124: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Especio = 1.0 versions...

CVE-2025-69117: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Ingenioso = 1.14.0 versions...

CVE-2026-39523: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Solene Core = 2.3.2 versions...

CVE-2026-39522: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Solene = 3.4 versions...

CVE-2025-69114: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in MaxiNet = 1.2.10 versions...

CVE-2025-2863: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web application of saTECH BCU firmware version 2.1.3, which could allow an unauthenticated local attacker to exploit active administrator sessions and perform malicious actions. The malicious actions that can be executed by the attacker depend ...

CVE-2023-52952: Improper Protection of Alternate Path

A vulnerability has been identified in HiMed Cockpit 12 pro J31032-K2017-H259 All versions = V11.5.1 = V11.5.1 = V11.5.1 = V11.5.1 V11.6.2. The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to...

PHOENIX CONTACT CHARX SEC Input Validation Error Vulnerability

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. An input validation error vulnerability exists in PHOENIX CONTACT CHARX SEC-3000 versions prior to v1.5.1, which stems from incorrect input validation and allows an unauthenticated local attacker to...

CVE-2020-27225

In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to the local help web server, allowing an unauthenticated local attacker to issue active help commands to the associated Eclipse Platform process or Eclipse Rich Client Platform...

CVE-2019-9534: Download of Code Without Integrity Check

The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to...

CVE-2019-1586: Incomplete Cleanup

A vulnerability in Cisco Application Policy Infrastructure Controller APIC Software could allow an unauthenticated, local attacker with physical access to obtain sensitive information from an affected device. The vulnerability is due to insecure removal of cleartext encryption keys stored on loca...

CVE-2019-2544: Undefined Security Weakness

Vulnerability in the Oracle Solaris component of Oracle Sun Systems Products Suite subcomponent: Kernel. Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromis...

CVE-2018-3003: Undefined Security Weakness

Vulnerability in the Oracle Hospitality Cruise Fleet Management System component of Oracle Hospitality Applications subcomponent: Fleet Management System Suite. The supported version that is affected is 9.x. Easily exploitable vulnerability allows unauthenticated attacker with logon to the...

CVE-2018-2754: Undefined Security Weakness

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: ZVNET Driver. The supported version that is affected is 11.3. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris executes to compromise Solaris...

CVE-2018-5708: Insufficiently Protected Credentials

An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a user can obtain the admin username and cleartext password in the response specifically, the configuration file restoredefault, which is...

CVE-2017-12223: Improper Input Validation

A vulnerability in the ROM Monitor ROMMON code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local attacker to boot an unsigned Hypervisor on an affected device and compromise the integrity of the system. The vulnerability is due to insufficient sanitization o...

CVE-2017-10220: Undefined Security Weakness

Vulnerability in the Hospitality Property Interfaces component of Oracle Hospitality Applications subcomponent: Parser. The supported version that is affected is 8.10.x. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Hospitality Property...