CVE-2025-50428

In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sanitizing of user input passed via the interface parameter...

PT-2025-34893

Name of the Vulnerable Software and Affected Versions: Cisco UCS Manager Software affected versions not specified Description: A vulnerability exists in the web-based management interface that could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack agains...

PT-2025-34878 · Unknown · Diskover-Web

Name of the Vulnerable Software and Affected Versions: diskover-web version 2.3.0 Description: The software is susceptible to multiple reflected cross-site scripting XSS flaws within its web interface. Unsanitized GET parameters, including maxage, maxindex, index, path, q query, and doctype, are...

Linux Distros Unpatched Vulnerability : CVE-2017-17536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary...

Cisco IOS XE CSRF

The vulnerability in the web interface for controlling Cisco IOS XE operating systems is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

Cisco IOS XE Data Compromise

The vulnerability of the Cisco IOS XE operating system’s web management interface relates to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality and integrity...

Cisco IOS XE Data Compromise

The vulnerability of the Cisco IOS XE operating system’s web management interface is related to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality of protect...

Cisco Catalyst SD-WAN Manager XSS

The vulnerability in the web interface of the Cisco Catalyst SD-WAN Manager relates to the lack of security measures taken to protect the web page structure. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks...

Cisco Firepower Management Center SSRF

The vulnerability of the web interface of the Cisco Firepower Management Center FMC software management system is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

Cisco Evolved Programmable Network Manager Privilege Escalation

The vulnerability of the Cisco Evolved Programmable Network Manager and the Cisco Prime Infrastructure network lifecycle management software lies in the possibility of unlimited loading of malicious files. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to...

egOS Web Interface Bypass Unauthorized Access

The vulnerability of the egOS web interface for Welotec industrial devices relates to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and gain unauthorized access to the device by creating HS256 tokens...

CVE-2025-50985

diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws within its web interface. The vulnerability is caused by the improper neutralization of input, where unsanitized GET parameters —specifically maxage, maxindex, index, path, q (query), and do...

CVE-2025-36729

A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including the master admin password. This vulnerability also allows the user to give themselves shell access with the root gid...

CVE-2025-36729

The connected sources confirm CVE-2025-36729 concerns RACOM M!DGE2 devices where a non-primary administrator with web-interface rights (no shell access) can view device configuration, exposing the master admin password, and can escalate to shell access with root gid. The root cause is improper pe...

CVE-2025-36729 RACOM M!DGE2 Privilege Escalation via SDK Testing Endpoint

A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including the master admin password. This vulnerability also allows the user to give themselves shell access with the root gid...

PT-2025-34793 · Ubiquiti · Ubiquiti Unifi

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A non-primary administrator user with admin rights to the web interface, but without shell access permissions, can view the device configuration, including the master admin password. This also allo...

PT-2025-34808 · Ipfire · Ipfire

Name of the Vulnerable Software and Affected Versions: IPFire version 2.29 Description: The web-based firewall interface firewall.cgi fails to sanitize several rule parameters, including PROT, SRC PORT, TGT PORT, dnatport, key, ruleremark, src addr, std net tgt, and tgt addr. This allows an...

CVE-2025-50975

IPFire 2.29 web-based firewall interface firewall.cgi fails to sanitize several rule parameters such as PROT, SRCPORT, TGTPORT, dnatport, key, ruleremark, srcaddr, stdnettgt, and tgtaddr, allowing an authenticated administrator to inject persistent JavaScript. This stored XSS payload is executed...

PT-2025-34744

Name of the Vulnerable Software and Affected Versions: egOS WebGUI affected versions not specified Description: The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass...

Linux Distros Unpatched Vulnerability : CVE-2017-7178

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves 1 hosting a crafted plugin that executes an arbitrary program...