The vulnerability of the formSetDeviceName and sub_C6BB0 functions in the Tenda AC18 router’s microprogramming system allows a hacker to induce a service failure.

The vulnerability of the formSetDeviceName and subC6BB0 functions in the Tenda AC18 router’s microprogramming system lies in the possibility of copying input data into the buffer without checking its size. Exploiting this vulnerability could allow a malicious actor to cause a service failure by...

Selesta Visual Access Manager 安全漏洞

Selesta Visual Access Manager is a visual access manager from Selesta. A SQL injection vulnerability exists in Selesta Visual Access Manager. The vulnerability stems from the application's lack of validation of externally entered SQL statements and is exploited by an attacker to perform SQL...

Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

Impact Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers...

GHSA-J3F9-P6HM-5W6Q Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

Impact Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers...

CVE-2025-22145 Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are a...

CVE-2025-22145

Carbon (PHP DateTime extension) has a vulnerability where unsanitized input passed to Carbon::setLocale could lead to arbitrary file include if a PHP file is uploaded in a folder that is includable. This affects users of the Carbon extension and is mitigated by fixes in Carbon release 3.8.4 and 2...

ClipBucket 路径遍历漏洞

ClipBucket is an open source and freely downloadable PHP script from MacWarrior Open Source. It is used for sharing video sites. ClipBucket V5 5.5.1 - A security vulnerability exists in version 236 and prior versions that stems from not checking for path traversal sequences in the provided user...

PT-2025-25395

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue allows for arbitrary directory creation or file deletion. In the find file method of the GitFS class, a path is created using os.path.join with unvalidated input from the tgt env...

Ashlar Vellum Cobalt 安全漏洞

Ashlar Vellum Cobalt is a parameter-based computer-aided design and 3D modeling program from Ashlar, Inc. A security vulnerability exists in Ashlar Vellum Cobalt that stems from the failure to properly validate the length of user-supplied data before copying it to a stack-based buffer. An attacke...

Ashlar Vellum Cobalt 缓冲区错误漏洞

Ashlar Vellum Cobalt is a parameter-based computer-aided design and 3D modeling program from Ashlar. Ashlar Vellum Cobalt suffers from a buffer error vulnerability that stems from a lack of proper validation of user-supplied data. An attacker could exploit the vulnerability to execute code in the...

Simple Chat System 注入漏洞

Chat System is a chat system. Chat System suffers from a SQL injection vulnerability that stems from a lack of adequate validation of the input of the id parameter in the /admin/updateuser.php file. No details of the vulnerability are available at this time...

Arista NG Firewall 操作系统命令注入漏洞

Arista NG Firewall is a WEB firewall from Arista USA. Arista NG Firewall suffers from an operating system command injection vulnerability that stems from a lack of proper validation before executing a system call using a user-supplied string, resulting in a command injection remote code execution...

PT-2024-17488 · Horner Automation · Cscape

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue occurs in the parsing of CSP files due to the lack of proper validation of user-supplied data. This could allow reading past the end of...

CVE-2024-11950

XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of XnSoft XnView Classic. User interaction is required to exploit this vulnerability in that the target must...

About Elevation of Privilege – PAN-OS (CVE-2024-9474) vulnerability

About Elevation of Privilege - PAN-OS CVE-2024-9474 vulnerability. An attacker with PAN-OS administrator access to the management web interface can perform actions on the Palo Alto device with root privileges. Linux commands can be injected via unvalidated input in script. The need for...

WordPress plugin InPost Gallery 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

PT-2024-10927 · Qualcomm · Snapdragon +73

Name of the Vulnerable Software and Affected Versions: Audio module affected versions not specified Description: The issue is related to a possible out of bound access in the audio module due to the lack of validation of user-provided input. Recommendations: At the moment, there is no information...

Wyze Cam 操作系统命令注入漏洞

Wyze Cam Wyze Labs is a series of cameras from Wyze USA. Wyze Cam v3 suffers from an operating system command injection vulnerability that stems from a lack of proper validation before executing a system call using a user-supplied string. An attacker exploiting this vulnerability could execute...

PT-2024-32621 · Myscada · Myscada Mypro Manager

Name of the Vulnerable Software and Affected Versions: mySCADA myPRO Manager affected versions not specified Description: A parameter within a command does not properly validate input, which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. Th...

PT-2024-17038 · Irfanview · Irfanview

Name of the Vulnerable Software and Affected Versions: IrfanView affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this issue, where the target must visit a...