CVE-2025-25053

CVE-2025-25053 describes an OS command injection in the WEB UI (settings page) of Inaba Denki Sangyo Wi‑Fi AP UNIT AC-WPS-11ac series. A remote attacker who can log in may execute arbitrary OS commands due to this input handling flaw. Affected are pre‑patch firmware versions; vendor‑provided fixe...

CVE-2025-23407

Incorrect privilege assignment vulnerability in the WEB UI the setting page exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote attacker who can log in to the product may alter the settings without appropriate privileges...

PT-2025-15677 · Unknown · Ac-Wps-11Ac Series

Name of the Vulnerable Software and Affected Versions: AC-WPS-11ac series affected versions not specified Description: A remote attacker who can log in to the product may alter the settings without appropriate privileges due to an incorrect privilege assignment vulnerability in the WEB UI setting...

Inaba Denki Sangyo Wi-Fi AP UNIT 操作系统命令注入漏洞

The Inaba Denki Sangyo Wi-Fi AP UNIT is a Wi-Fi AP unit from Inaba Denki Sangyo, a Japanese company. An OS command injection vulnerability exists in Inaba Denki Sangyo Wi-Fi AP UNIT v2.0.03P and earlier versions, which originates from an OS command injection on the WEB UI settings page and could...

PT-2025-15678

Name of the Vulnerable Software and Affected Versions: Wi-Fi AP UNIT 'AC-WPS-11ac series' affected versions not specified Description: A remote attacker who can log in to the product may execute an arbitrary OS command due to an OS command injection vulnerability in the WEB UI setting page. This...

CVE-2023-33844: Improper Neutralization of Input During Web Page Generation

IBM Security Verify Governance 10.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-25053: Improper Neutralization of Special Elements used in an OS Command

OS command injection vulnerability in the WEB UI the setting page exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product...

CVE-2025-23407: Incorrect Privilege Assignment

Incorrect privilege assignment vulnerability in the WEB UI the setting page exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote attacker who can log in to the product may alter the settings without appropriate privileges...

CVE-2024-56341

IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-0272 HCL DevOps Deploy / HCL Launch is susceptible to an HTML injection vulnerability

HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure...

PT-2025-14767 · Hcl · Hcl Devops Deploy +1

Name of the Vulnerable Software and Affected Versions: HCL DevOps Deploy / HCL Launch affected versions not specified Description: The issue allows a user to embed arbitrary HTML tags in the Web UI, potentially leading to sensitive information disclosure. This is due to an HTML injection...

CVE-2024-56475 IBM TXSeries for Multiplatforms cross-site scripting

IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2025-14520 · Ibm · Ibm Txseries For Multiplatforms

Name of the Vulnerable Software and Affected Versions: IBM TXSeries for Multiplatforms versions 9.1 through 11.1 Description: The issue allows an authenticated user to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

CVE-2024-56475: Improper Neutralization of Input During Web Page Generation

IBM TXSeries for Multiplatforms 9.1 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2024-56341: Improper Neutralization of Input During Web Page Generation

IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

FAST LTA Silent Brick WebUI 安全漏洞

The FAST LTA Silent Brick WebUI is a web-based user interface for a Silent Brick data storage system from FAST LTA. A security vulnerability exists in FAST LTA Silent Brick WebUI versions prior to 2.63, which stems from operating system command injection and could allow a remote attacker to execu...

CVE-2025-1997: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

IBM UrbanCode Deploy UCD 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentiall...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to cross-site scripting (CVE-2022-30615, CVE-2022-35642)

Summary A cross-site scripting vulnerability in InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2022-30615 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W...

CVE-2024-12065

A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04. This vulnerability allows an attacker to access any file on the system by sending multiple crafted requests to the server. The issue is due to improper input validation in the gradio web UI component...

GHSA-JRHC-9QG9-4QFQ Open WebUI Allows Arbitrary File Reading and Deletion

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all...