CVE-2025-23059

A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If exploited successfully, this vulnerability allows an authenticated remote attacker with high privileges to access and retrieve sensitive...

CVE-2025-0630: External Control of File Name or Path

Multiple Western Telematic WTI products contain a web interface that is vulnerable to a local file inclusion attack LFI, where any authenticated user has privileged access to files on the device's filesystem...

Security update for cups

This update for cups fixes the following issues: Version upgrade to 2.4.11: See https://github.com/openprinting/cups/releases CUPS 2.4.11 brings several bug fixes regarding IPP response validation, processing PPD values, Web UI support checkbox support, modifying printers and others fixes. Detail...

Cacti Web Interface Unauthorized Access

The vulnerability of the web interface of the Cacti network monitoring software is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2025-2760 · Ibm · Ibm Sterling B2B Integrator

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator versions 6.0.0.0 through 6.1.2.5 IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.3 Description: The issue allows an authenticated user to embed arbitrary JavaScript code in the Web UI, altering the...

EDIMAX BR-6476AC Privilege Escalation Command Injection

The vulnerability of the web interface of the microprogrammed software router EDIMAX BR-6476AC is related to the lack of measures taken for data cleaning at the management level. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and execute arbitrary commands...

EDIMAX BR-6476AC Privilege Escalation Command Injection

The vulnerability of the web interface of EDIMAX BR-6476AC microprogrammed software routers lies in the falsification of inter-site requests due to incorrect processing of special symbols. Exploiting this vulnerability allows a remote attacker to enhance their privileges and execute arbitrary...

TP-Link Archer A20 Web Interface Code Execution

The vulnerability of the web interface for managing TP-Link Archer A20 wireless routers involves a lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary code, provided that the user specifically submits a specially crafted G...

CVE-2024-57514

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

CVE-2025-23054

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files,...

CVE-2025-23055

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the...

CVE-2025-23053

A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...

SUSE CVE-2024-45598

Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the Poller Standard Error Log Path parameter in either Installation Step 5 or in Configuration-Settings-Paths tab to a local file inside the server. Then simply going to Logs tab and...

CVE-2024-57514

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

CVE-2024-57514

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

PT-2025-3886 · Hms Industrial Networks · Ewon Flexy 202

Name of the Vulnerable Software and Affected Versions: EWON Flexy 202 affected versions not specified Description: The issue concerns the transmission of user credentials in clear text without encryption when a user is added or user credentials are changed via the device's webpage. This affects t...

CVE-2024-57514: Improper Neutralization of Input During Web Page Generation

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

STEALTHONE D220 D340 Unauthorized Access

The vulnerability of the web interface for managing microprogramming software-based network storage devices STEALTHONE D220 and D340 is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

Aim Web Interface DoS

The vulnerability of the software interface for monitoring and registering machine learning experiments related to Aim is associated with blocking the server during processing due to uncontrolled resource consumption. Exploiting this vulnerability allows a malicious actor to cause service failure...

TP-LINK Archer A20 security vulnerabilities

TP-LINK Archer A20 is a router from China P&L TP-LINK. A security vulnerability exists in TP-LINK Archer A20 version v3, which originates from improper handling of directory listing paths in the web interface. An attacker can exploit the vulnerability to inject malicious code into a page and...