CVE-2023-31853

CVE-2023-31853 Cudy LT400의 웹 기반 관리 인터페이스에 반사형 크로스 사이트 스크립팅XSS 공격이 존재합니다. /cgi-bin/luci/admin/network/bandwidth 페이지에서 icon 파라미터를 통해 반사형 XSS가 발생합니다. 공격 방법은 피해자에게 악성 코드가 포함된 특수하게 조작된 요청을 보내는 것입니다. 영향을 받는 애플리케이션은 세션 쿠키에 HttpOnly 속성을 설정하지 않으며, 이로 인해 세션 토큰 도난을 통해 관리자 계정을 탈취할 수 있습니다. PoC root@kitploit:...

CVE-2024-20404

Descrizione Una vulnerabilità nell'interfaccia di gestione basata sul web di Cisco Finesse potrebbe consentire a un attaccante remoto non autenticato di condurre un attacco SSRF su un sistema interessato. Questa vulnerabilità è dovuta a una validazione insufficiente dell'input fornito dall'utente...

CVE-2025-70545

Router PPC Belden ONT 2K05X Autore: Jeyabalaji Codice prodotto interessato: Router PPC 2K05X - V1.1.9206L Testato su: Windows 11 CVE: CVE-2025-70545 Descrizione: Esiste una vulnerabilità di cross-site scripting XSS persistente nell'interfaccia di gestione web del router PPC Belden ONT 2K05X con...

CVE-2026-63586

CVE-2026-63586 is a critical (CVSS 3.1: 9.8) unauthenticated remote code execution vulnerability in a web-based management interface that uses a modified uhttpd server with CGI shell scripts. The root cause is a shell injection flaw: the HTTP Basic Authentication username is taken directly from t...

Evertz SDVN 3080ipx-10G - Unauthenticated Arbitrary Command Injection

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. This web management interface can be used by administrators to control product features, setup network switching, and register license among...

Cisco VPN Routers - Unauthenticated Arbitrary File Upload

A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...

FatPipe WARP/IPVPN/MPVPN - Authorization Bypass

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain a missing authorization caused by lack of access control in the web management interface, letting remote attackers access sensitive URLs, exploit requires no authentication. id: CVE-2021-27858 info: name:...

CVE-2020-13259

CVE-2020-13259 PoC di Account Takeover completo su RAD SecFlow-1v Una vulnerabilità nell'interfaccia di gestione basata sul web di RAD SecFlow-1v potrebbe consentire a un attaccante remoto non autenticato di condurre un attacco di cross-site request forgery CSRF su un sistema affetto. La...

CVE-2026-71926

Multiple DrayTek VigorSwitch models are affected by a command injection vulnerability in the setDevice function. The root cause is insufficient sanitization of the username, password, and location fields before command execution, allowing a remote attacker to run arbitrary commands with root priv...

CVE-2026-71904 DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the eventcode field is concatenated into a system command. A remote attacker can trigger this vulnerabili...

Cisco IOS XE Software Web Based Management Interface Denial of Service (cisco-sa-webui-dos-qdc7qx3)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability. - A denial of service DoS vulnerability exists in the web-based management interface of Cisco IOS XE Software due to insufficient input validation. An authenticated, remote attacker can exploit this issu...

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

Cisco Unified Intelligence Center < 12.6 / 12.6.x < 12.6(2) ES08 / 15.0.x < 15.0(1) SU2 SQL Injection (cisco-sa-cuic-sql-inject-2qbfWSm5)

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

EUVD-2026-63081

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...

CVE-2026-75616 Command Injection in Router Web Management Interface

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...

CVE-2026-20232

A vulnerability in the web-based management interface of Cisco Industrial Ethernet IE 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of...

CVE-2026-20232

The web-based management interface of Cisco IE 1000 Series Switches fails to validate user-supplied input, enabling an authenticated attacker to inject malicious script into specific pages that executes in another user's session (stored XSS). CVSS 5.4 (MEDIUM) requires valid credentials and user ...

PT-2026-78493

A vulnerability in the web-based management interface of Cisco Industrial Ethernet IE 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of...

PT-2026-78522

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-19745

A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilitiesconfigurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploi...