CVE-2025-29394

CVE-2025-29394 affects verydows v2.0. The issue is an insecure permissions flaw in file uploads that permits a remote attacker to execute arbitrary code. Root cause: improper handling of uploaded files (permissions) enabling code execution. Evidence across sources confirms impact as remote code e...

CVE-2025-29217

CVE-2025-29217 affects Tenda W18E (v2.0, v16.01.0.11). A stack overflow in the wifiSSID parameter handled by /goform/setModules can be triggered by a crafted POST request, leading to Denial of Service. The connected sources (CNVD/CNNVD/RH/NVD/CVELIST) confirm the vulnerability details but do not ...

CVE-2022-39213

go-cvss is a Go module to manipulate Common Vulnerability Scoring System CVSS. In affected versions when a full CVSS v2.0 vector string is parsed using ParseVector, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. The problem is patched in tag v0.4.0, by th...

CVE-2024-23812

A vulnerability has been identified in SINEC NMS All versions V2.0 SP1. The affected application incorrectly neutralizes special elements when creating a report which could lead to command injection...

CVE-2024-45299

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...

CVE-2024-42585

A Cross-Site Request Forgery CSRF in the component deletemedia.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges...

CVE-2024-42581

A Cross-Site Request Forgery CSRF in the component deletegroup.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges...

CVE-2024-42580

A Cross-Site Request Forgery CSRF in the component editgroup.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges...

CVE-2024-42584

A Cross-Site Request Forgery CSRF in the component deleteproduct.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges...

CVE-2024-42579

A Cross-Site Request Forgery CSRF in the component addgroup.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges...

CVE-2024-42584

A Cross-Site Request Forgery CSRF in the component deleteproduct.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges...

CVE-2024-42583

A Cross-Site Request Forgery CSRF in the component deleteuser.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges...

CVE-2024-42578

A Cross-Site Request Forgery CSRF in the component editproduct.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges...

CVE-2024-42583

A Cross-Site Request Forgery CSRF in the component deleteuser.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges...

CVE-2024-42584

CVE-2024-42584 affects Warehouse Inventory System v2.0, specifically the delete_product.php component. The CSRF vulnerability allows an unauthenticated attacker to induce a victim to perform privileged actions, enabling privilege escalation. Root cause is insufficient verification of request orig...

Minfotech CMS 2.0 SQL Injection

==================================================================================================================================== | Title : Minfotech CMS v2.0 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64 bits | |...

CVE-2022-48769

In the Linux kernel, the following vulnerability has been resolved: efi: runtime: avoid EFIv2 runtime services on Apple x86 machines Aditya reports 0 that his recent MacbookPro crashes in the firmware when using the variable services at runtime. The culprit appears to be a call to...

CVE-2024-33377

LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attackers can cause victim users to perform arbitrary operations via interaction with crafted elements on the web page...

CVE-2024-33375

LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware...

CVE-2024-33374

Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access the root terminal without authentication...