19998 matches found
CVE-2025-36754
Technical details (affected product/versions, root cause, exploit specifics) are not publicly provided in the connected documents. Monitor for updates.
CVE-2025-36754 Authentication bypass on web interface
The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an...
CVE-2025-36754 Authentication bypass on web interface
The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an...
PT-2025-51103
The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there is no session token or authentication in place. This would allow an attacker for instance to point the device to an...
Unraid Web Interface Detection
Binary data unraidwebdetect.nbin...
CVE-2025-66473
XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which doesn't enforce any limits for the number of items that can be requested in a single request at the moment. Depending on the number of...
CVE-2025-41692
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm...
WatchGuard Fireware Unauthorized Access
The vulnerability in the web interface of the WatchGuard Fireware operating system is related to errors in processing XML requests. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
FreePBX SQL Injection Vulnerability (CNVD-2025-3038208)
FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. FreePBX suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered S...
CVE-2025-65231
Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting XSS in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page...
CVE-2025-41692 Weak/Predictable root Password
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm...
CVE-2025-41692
CVE-2025-41692 describes a high-privilege remote attack against a webUI where an admin user can brute-force the underlying OS root and user passwords due to a weak password generation algorithm. Connected sources (Red Hat and NVD/NVD-derived entries) indicate potential downstream risks: separate ...
PT-2025-49811
Name of the Vulnerable Software and Affected Versions versions prior to 2025 Description A remote attacker with administrative privileges for the webUI can potentially compromise the system by brute-forcing the default passwords for the "root" and "user" accounts of the underlying operating syste...
Siemens SIMATIC CN 4100 command injection vulnerability
The Siemens SIMATIC CN 4100 is a communication node from Siemens, Germany. The Siemens SIMATIC CN 4100 suffers from a command injection vulnerability that stems from insufficient validation of REST API input parameters, which can be exploited by an attacker to cause execution of arbitrary code...
EUVD-2025-201805
Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting XSS in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page...
EUVD-2025-201811
A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller firmware 1.5.1799...
CVE-2025-65230
Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting XSS vulnerability in the Web UI Configuration Streaming Destination input...
CVE-2025-14126
A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. Affected is an unknown function of the component Web Interface. Such manipulation leads to hard-coded credentials. The attack needs to be initiated within the local network. The exploit has been disclosed to the publi...
CVE-2025-65229
A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server versions 9.0.3 and earlier . The issue is caused by a lack of proper output encoding when the server renders the Player name field from the Settings Player menu. An authenticated user can inject a...