CVE-2026-27511: Improper Restriction of Rendered UI Layers or Frames

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header, allowing attacker-controlled sites to embed administrative pages in an iframe and trick an...

CVE-2026-27513: Cross-Site Request Forgery (CSRF)

Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55multi contains a cross-site request forgery CSRF vulnerability in the web-based administrative interface. The interface does not implement anti-CSRF protections, allowing an attacker to induce an authenticated administrator to submit...

CVE-2026-22082: Session Fixation

This vulnerability exists in Tenda wireless routers 300Mbps Wireless Router F3 and N300 Easy Setup Router due to the use of login credentials as the session ID through its web-based administrative interface. A remote attacker could exploit this vulnerability by intercepting network traffic and...

CVE-2025-25613: Cleartext Storage of Sensitive Information

FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for their web based administrative application containing usernames and passwords. These were transmitted in cleartext usi...

CVE-2012-10028: Improper Neutralization of Special Elements used in an OS Command

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to surgeftpmgr.cgi. This can lead to full remote code execution on the underlying system...

Sipwise C5 NGCP CSC Cross Site Request Forgery

Sipwise C5 NGCP CSC CSRF Click2Dial Exploit Vendor: Sipwise GmbH Product web page: https://www.sipwise.com Affected version: =CEm39.3.1 NGCP wwwadmin version 3.6.7 Summary: Sipwise C5 also known as NGCP - the Next Generation Communication Platform is a SIP-based Open Source Class 5 VoIP soft-swit...

Cisco WebEx Meeting Center Web-Based Administrative Interface User Enumeration Vulnerability

A vulnerability in the web-based administrative interface of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to enumerate valid usernames and determine if the usernames have administrative privileges. The vulnerability is due to a logic error in the handling of invalid...

PT-2015-5571

Name of the Vulnerable Software and Affected Versions Sierra Wireless AirCard versions 760S, 762S, and 763S Description The issue concerns a CRLF injection vulnerability in the export.cfg file within the web-based administrative console. This vulnerability allows remote attackers to inject...

Ipswitch WhatsUp Professional 2006 Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/18019/info Ipswitch WhatsUp Professional 2006 is susceptible to a remote authentication-bypass vulnerability. This issue allows remote attackers to gain administrative access to the web-based administrative interface of t...

Netwin SurgeFTP Remote Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Netwin SurgeFTP...

Plesk Multiple Script PLESKSESSID Cookie SQL Injection

Binary data 4213.prm...

[SA19223] BorderWare MXtreme Web Administration Unspecified Vulnerability

TITLE: BorderWare MXtreme Web Administration Unspecified Vulnerability SECUNIA ADVISORY ID: SA19223 VERIFY ADVISORY: http://secunia.com/advisories/19223/ CRITICAL: Moderately critical IMPACT: Unknown WHERE: From remote OPERATING SYSTEM: Borderware MXtreme http://secunia.com/product/1842/...