CVE-2025-3899

CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in Certificates page on Webserver that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser...

CVE-2025-5742

CWE-79: Improper Neutralization of Input During Web Page Generation ‘Cross-site Scripting’ vulnerability exists when an authenticated user modifies configuration parameters on the web server...

CVE-2025-5742

CVE-2025-5742 : A cross-site scripting vulnerability exists in Schneider Electric EVLink WallBox. An authenticated user who modifies configuration parameters on the web server can trigger improper input neutralization during web page generation, potentially enabling XSS. Publicly available detail...

CVE-2025-5741

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause arbitrary file reads from the charging station. The exploitation of this vulnerability does require an authenticated session of the web server...

CVE-2025-5907

A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232B20210713. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The...

PT-2025-24628 · Schneider Electric · Modicon Controllers M241/M251 +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A Denial of Service issue exists due to improper input validation. This occurs when an authenticated malicious user sends an HTTPS request containing an invalid data type to the web server...

CVE-2025-30183

CyberData 011209 Intercom does not properly store or protect web server admin credentials...

CVE-2025-30183

CyberData 011209 Intercom does not properly store or protect web server admin credentials...

CVE-2025-30183

CVE-2025-30183 – CyberData 011209 Intercom : The Connected documents corroborate a vulnerability where the Intercom web interface may be accessed without authentication via an alternate path, enabling potential disclosure of sensitive data, denial of service, or even code execution. Root cause: i...

CVE-2025-30183 CyberData 011209 SIP Emergency Intercom Insufficiently Protected Credentials

CyberData 011209 Intercom does not properly store or protect web server admin credentials...

HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

Summary An authenticated Local File Inclusion LFI vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as...

The vulnerability in the built-in web server boa (/boafrm/formReflashClientTbl) of TOTOLINK X15 router microprogramming software allows a perpetrator to execute arbitrary commands or cause a service failure.

The vulnerability of the built-in web server software boa /boafrm/formReflashClientTbl of TOTOLINK X15 routers is related to the issue where the operation exceeds the buffer limits in memory when processing the submit-url parameter. Exploiting this vulnerability allows a remote attacker to execut...

The vulnerability of the built-in web server boa (/boafrm/formWsc) of TOTOLINK X15 router’s microprogramming software allows a intruder to execute arbitrary commands or cause a service failure.

The vulnerability of the built-in web server boa /boafrm/formWsc of TOTOLINK X15 routers is related to the issue where the operation’s output goes beyond the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

The vulnerability of the built-in web server boa (/boafrm/formIpQoS) of TOTOLINK X15 router’s microprogramming software allows a intruder to execute arbitrary commands or cause a service failure.

The vulnerability of the built-in web server boa /boafrm/formIpQoS of TOTOLINK X15 router software is related to the issue of the operation exceeding the buffer in memory when processing the mac parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands or cau...

The vulnerability in the built-in web server boa (/boafrm/formWirelessTbl) of TOTOLINK X15 router microprogramming software allows a intruder to execute arbitrary commands or cause a service failure.

The vulnerability of the built-in web server boa /boafrm/formWirelessTbl of TOTOLINK X15 router microprogramming software is related to the issue where the operation results are written out of the buffer into memory when processing the submit-url parameter. Exploiting this vulnerability allows a...

PT-2025-24574 · Cyberdata · Cyberdata 011209 Intercom

Name of the Vulnerable Software and Affected Versions: CyberData 011209 Intercom affected versions not specified Description: The issue concerns the improper storage or protection of web server admin credentials. Recommendations: At the moment, there is no information about a newer version that...

CyberData 011209 Intercom 安全漏洞

CyberData 011209 Intercom is an emergency call appliance from CyberData USA . A security vulnerability exists in CyberData 011209 Intercom that stems from not properly storing web server administrator credentials...

The vulnerability of the built-in web server boa (/boafrm/formDMZ) of TOTOLINK X15 router’s microprogramming software allows a perpetrator to execute arbitrary commands or cause service failure.

The vulnerability of the built-in web server boa /boafrm/formDMZ of TOTOLINK X15 router microprogramming software is related to the issue of the operation exceeding the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerability of the built-in web server boa (/boafrm/formPortFw) of TOTOLINK X15 router’s microprogramming software allows a perpetrator to execute arbitrary commands or cause service interruptions.

The vulnerability of the built-in web server boa /boafrm/formPortFw of TOTOLINK X15 router microprogramming software is related to the issue of the operation exceeding the buffer in memory when processing the servicetype parameter. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2025-49007

Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can caus...