CVE-2019-11287

CVE-2019-11287: RabbitMQ Web管理插件中的堆溢出导致拒绝服务 Pivotal RabbitMQ 版本 3.7.x 低于 3.7.21 和 3.8.x 低于 3.8.1，以及 RabbitMQ for Pivotal Platform 的 1.16.x 版本低于 1.16.7 和 1.17.x 版本低于 1.17.4，包含一个易受拒绝服务攻击的 Web 管理插件。 可以利用 "X-Reason" HTTP 头部插入恶意的 Erlang 格式字符串，该字符串会扩展并消耗堆内存，导致服务器崩溃。 厂商披露： 该漏洞的厂商披露和修复方案可在此处找到here。 条件：...

CVE-2021-35492

漏洞信息 漏洞标题： Wowza Streaming Engine 4.8.11+5 - 拒绝服务 CVE： CVE-2021-35492 日期： 2021-10-06 漏洞作者： N4nj0 软件链接： https://www.wowza.com/products/streaming-engine 版本： 4.8.11+5 测试环境： Wowza Streaming Engine = 4.8.11+5 漏洞公告： https://n4nj0.github.io/advisories/wowza-streaming-engine-i/ TWowza Streaming Engine（原名...

CVE-2023-31853

CVE-2023-31853 Cudy LT400 基于 Web 的管理界面存在反射型跨站脚本（XSS）攻击。 页面 /cgi-bin/luci/admin/network/bandwidth 通过 icon 参数存在反射型 XSS。 利用方法涉及向受害者发送特制请求，其中包含恶意代码。 受影响的应用未在 Session Cookie 中设置 HttpOnly 属性；这可能导致通过会话令牌窃取实现管理员接管。 PoC GET...

CVE-2020-13259

CVE-2020-13259 RAD SecFlow-1v 完全账户接管 PoC RAD SecFlow-1v 的基于 Web 的管理接口存在一个漏洞，可能允许未经验证的远程攻击者在受影响系统上实施跨站请求伪造 CSRF 攻击。 该漏洞是由于受影响设备对 Web UI 的 CSRF 保护不足所致。 攻击者可通过诱骗接口用户点击恶意链接来利用此漏洞。成功利用后，攻击者能够以受影响用户的权限等级执行任意操作。 该漏洞可与 CVE-2020-13260 结合利用。 概念验证 通过诱骗已认证用户打开包含 JS 代码的网页。 此攻击可执行基于 Web...

Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among...

Karel IP Phone IP1211 Web Management Panel - Local File Inclusion

Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter. id: CVE-2025-34023 info: name: Karel IP Phone IP1211 Web Management Pane...

FatPipe WARP/IPVPN/MPVPN - Authorization Bypass

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain a missing authorization caused by lack of access control in the web management interface, letting remote attackers access sensitive URLs, exploit requires no authentication. id: CVE-2021-27858 info: name:...

Viessmann Vitogate 300 - Hardcoded Password

A critical vulnerability in Viessmann Vitogate 300 up to 2.1.3.0 allows attackers to authenticate using hardcoded credentials in the Web Management Interface. id: CVE-2023-5222 info: name: Viessmann Vitogate 300 - Hardcoded Password author: ritikchaddha severity: critical description: | A critica...

EUVD-2026-91836

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2026-84411

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2017-6079-Blind-Command-Injection-In-Edgewater-Edgemarc-Devices-Exploit

介绍 此漏洞利用是基于depthsecurity的技术描述开发的 https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices 描述 Edgewater Networks Edgemarc设备上的HTTP Web管理应用程序有一个隐藏页面，允许设置用户自定义命令，例如特定的iptables路由等。你实际上可以将此页面用作Web...

CVE-2026-84411

The web management service in MikroTik RouterOS versions prior to 7.24 is vulnerable to an integer underflow in its HTTP request body handling. This flaw is reachable before authentication , allowing an unauthenticated network attacker to achieve arbitrary code execution as root or cause a denial...

CVE-2026-84411 MikroTik RouterOS Integer Underflow

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2021-40904

CVE-2021-40904 - 通过CheckMk的Dokuwiki嵌入式应用程序实现远程代码执行（RCE） 应用程序： CheckMK管理Web控制台 软件版本： 从1.5.0到1.5.0p25 攻击类型： 远程代码执行（RCE） 解决方案： 升级至1.6或更高版本。 概述： CheckMk Raw Edition（版本1.5.0至1.5.0p25）的Web管理控制台存在对默认安装的Web应用Dokuwiki的配置错误，允许嵌入PHP代码。因此可实现远程代码执行。成功利用需要访问Web管理界面，用户需具备有效凭据或通过管理员角色劫持会话。 技术描述： 参见 CVE-2021-4090...

Cisco VPN Routers - Unauthenticated Arbitrary File Upload

A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...

MikroTik RouterOS < 7.24 Web Management Integer Underflow RCE (CVE-2026-84411)

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS prior to 7.24. It is, therefore, affected by a remote code execution vulnerability. The web management service in affected RouterOS versions contains an integer underflow in its HTTP...

CVE-2026-36958

CVE-2026-36958: Denegación de Servicio mediante Solicitudes HTTP Concurrentes ID CVE: CVE-2026-36958 Fecha: 2026-04-29 Descubridor: Kirubel Solomne Proveedor: U-SPEED Producto: Router U-SPEED Versión de Firmware: V1.0.0 CWE: CWE-400 - Consumo de Recursos No Controlado Descripción El firmware V1.0...

CVE-2026-78249

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

EUVD-2026-90549

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...

CVE-2026-78249

A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...