MAL-2025-29386 Malicious code in playground-wizard (npm)

The package playground-wizard was found to contain malicious code...

CVE-2013-10070: Improper Neutralization of Directives in Dynamically Evaluated Code

PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval without sanitization. A remote attacker can exploit this flaw by crafting a request that injects arbitrary PHP code, resulting in command execution...

D-Link DIR-619L Router Form Set WAN XSS

The vulnerability of the formAdvanceSetup function /goform/formAdvanceSetup of the D-Link DIR-619L router’s microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

CVE-2025-41679

An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard Conftool service...

D-Link DIR-619L security vulnerabilities

The D-Link DIR-619L is a wireless router from China's AUO D-Link. The D-Link DIR-619L suffers from a stack buffer overflow vulnerability caused by incorrect boundary checking in function formSetWANTypeWizard5 in file /goform/formSetWANTypeWizard5. An attacker could exploit this vulnerability to...

D-Link DIR-619L security vulnerabilities

The D-Link DIR-619L is a wireless router from China-based AUO D-Link. A security vulnerability exists in the D-Link DIR-619L version 2.06B01, which stems from the improper handling of the parameter curTime in the file /goform/formSetWANWizard51, which may result in a stack buffer overflow...

@4via6/relay (>=1.0.0, <=1.1.3), @axonpush/wizard (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2025-52882 via @anthropic-ai/claude-code (>=0.2.126, <=1.0.8)

@anthropic-ai/claude-code NPM version =0.2.126, =1.0.0, =0.0.1, =0.0.4 - locadex 0.0.2-alpha.1 Source cves: CVE-2025-52882 Source advisory: GHSA-9F65-56V6-GXW7...

CVE-2025-6371

A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launch...

WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WP Wizard Cloak versions = 1.0.1...

CVE-2025-46612: Unrestricted Upload of File with Dangerous Type

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console default credentials are weak and easily guessable...

CVE-2025-5573

A vulnerability was found in D-Link DCS-932L 2.18.01. It has been rated as critical. Affected by this issue is the function setSystemWizard/setSystemControl of the file /setSystemWizard. The manipulation of the argument AdminID leads to os command injection. The attack may be launched remotely. T...

D-Link DCS-932L security vulnerability

The D-Link DCS-932L is a network surveillance camera from China AUO D-Link. It is used for security and surveillance. The D-Link DCS-932L suffers from a command injection vulnerability that stems from the failure of the parameter AdminID in the file /setSystemWizard to correctly filter constructe...

Exploit for Cross-site Scripting in Ibm Qradar_Security_Information_And_Event_Manager

CVE-2024-28784 — Stored XSS in IBM QRadar SIEM Rule Wizard...

Debian: Security Advisory (DLA-4196-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dla-4196 : accountwizard - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4196 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4196-1 [email protected] https://www.debian.org/lts/security/...

[SECURITY] [DLA 4196-1] kmail-account-wizard security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4196-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz May 30, 2025 https://wiki.debian.org/LTS -...

DLA-4196-1 kmail-account-wizard - security update

Bulletin has no description...

CVE-2024-5939

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setupwizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the...

CVE-2024-1322

The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setupwizard' function in all versions up to, and including, 7.8.4. This makes it possible for...

CVE-2024-11764

The Solar Wizard Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'solarwizard' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...