TOTOLINK X18 Command Injection Vulnerability

TOTOLINK X18 is a Gigabit router from China's Gion Electronics TOTOLINK. TOTOLINK X18 version 9.1.0cu.2024B20220329 suffers from a command injection vulnerability that stems from the parameter enable in file /cgi-bin/cstecgi.cgi failing to correctly filter constructed command special characters,...

YesWiki cross-site scripting vulnerability (CNVD-2025-03330)

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative way. A cross-site scripting vulnerability exists in YesWiki 4.4.5 and earlier versions, which stems from improper input validation when the attach component...

Arbitrary File Download Vulnerability in AnalyticsCloud of Beijing Zhiyuan Internet Software Co.

AnalyticsCloud AnalyticsCloud is a platform that integrates advanced data analytics technologies and tools to process data from a variety of data sources, including cloud data, local data, traditional data, and big data. An arbitrary file download vulnerability exists in AnalyticsCloud of Beijing...

ASUS RT-N12E Cross-Site Scripting Vulnerability

The ASUS RT-N12E is a wireless router from the Chinese company ASUS. A cross-site scripting vulnerability exists in ASUS RT-N12E version 2.0.0.19, which stems from the lack of effective filtering and escaping of user-supplied data in the SSID parameter of the sysinfo.asp file, which can be...

IBM QRadar SIEM Cross-Site Scripting Vulnerability (CNVD-2025-04167)

IBM QRadar SIEM is a solution from International Business Machines IBM that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user...

Cisco BroadWorks Denial of Service Vulnerability

Cisco BroadWorks is a carrier-grade unified communications software platform from Cisco. It is used to deploy cloud calls from public network platforms on any type of wired or wireless network architecture. A denial of service vulnerability exists in Cisco BroadWorks that stems from improper memo...

Online Shopping Portal /shopping/track-orders.php SQL Injection Vulnerability

Online Shopping Portal is an online store. Online Shopping Portal suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in /shopping/track-orders.php. No details of the vulnerability are available at this time...

SAP NetWeaver Application Server Java Information Disclosure Vulnerability (CNVD-2025-03268)

SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used to develop and run Java EE applications. An information disclosure vulnerability exists in SAP NetWeaver Application Server Java, which can b...

Huawei HarmonyOS Gallery Module Arbitrary Write Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An arbitrary write vulnerability exists in the Huawei HarmonyOS Gallery module, which can be exploited by an attacker to compromise confidentiality...

Siemens SiPass Integrated Third-Party Component DotNetZip Directory Traversal Vulnerability

Siemens SiPass integrated is a powerful and flexible access control system for organizations of all sizes, from simple offices to large complex facilities containing thousands of doors, gates, barriers and elevators. A directory traversal vulnerability exists in DotNetZip, a third-party component...

Unspecified Vulnerability in IBM ApplinX (CNVD-2025-04982)

IBM ApplinX is an International Business Machines IBM company focused on converting green screen interfaces into modern web-based applications. A security vulnerability exists in IBM ApplinX. An attacker could exploit the vulnerability to obtain sensitive information when the browser returns a...

Cisco AsyncOS Cross-Site Scripting Vulnerability (CNVD-2025-03528)

Cisco AsyncOS is an operating system for Cisco devices from Cisco USA. A cross-site scripting vulnerability exists in Cisco AsyncOS that originates from improper user input validation and can be exploited by a remote attacker to execute arbitrary script code or access sensitive information via a...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2025-07327)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. F5 BIG-IP suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and...

Unspecified Vulnerability in F5 BIG-IP PEM (CNVD-2025-07324)

F5 BIG-IP PEM is a policy enforcer used in BIG-IP from F5 USA. A security vulnerability exists in F5 BIG-IP PEM that can be exploited by an attacker to cause the Traffic Management Microkernel TMM to terminate when configuring URL categorization on a virtual server...

D-Link DIR-825 Command Injection Vulnerability

The D-Link DIR-825 is a router from China's AUO D-Link. A command injection vulnerability exists in the DLINK DIR-825 REVB version 2.03, which originates from a failure to properly filter construct command special characters, commands, etc. in the CGl interface apcclientpin.cgi. A remote attacker...

CMSimple has an unspecified vulnerability

CMSimple is a free content management system. An unspecified vulnerability exists in CMSimple, which can be exploited by an attacker to obtain sensitive information via a carefully crafted script that can be used to validate link functionality...

Apache James Resource Management Error Vulnerability

Apache James is the United States Apache Apache Foundation of a completely written in Java open source Smtp and Pop3 mail transfer agent and Nntp news server . Apache James suffers from a Resource Management Error vulnerability that stems from uncontrolled resource consumption by the application,...

Unspecified Vulnerability in LunaSVG

LunaSVG is a standalone C SVG rendering library. A security vulnerability exists in LunaSVG that stems from a segmentation violation via the component grayfindcell inclusion. No detailed vulnerability details are provided at this time...

F5 BIG-IP Uncontrolled Resource Consumption Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An uncontrolled resource consumption vulnerability exists in F5 BIG-IP, which can be exploited by an attacker to cause a denia...

JetBrains Hub Elevation of Privilege Vulnerability

JetBrains Hub is a web-based application from the Czech company JetBrains. The program is capable of integrating multiple JetBrains team tools together. JetBrains Hub suffers from an elevation of privilege vulnerability that originates from an elevation of privilege via LDAP authentication mappin...

GNU C Library Buffer Overflow Vulnerability

The GNU C Library is an open source, free C language compiler from the GNU community released under the LGPL license. GNU C Library suffers from a buffer overflow vulnerability that stems from not allocating enough space for assertion failure message strings and size information when the assert...

Huawei HarmonyOS ParamWatcher Module Identity Verification Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An identity verification vulnerability exists in the Huawei HarmonyOS ParamWatcher module, which can be exploited by an attacker to compromise confidentialit...

Dell SupportAssist OS Recovery Symbolic Link Attack Vulnerability

Dell SupportAssist OS Recovery is a built-in recovery tool for Dell computers, which is mainly used to solve system problems or hardware failures. Dell SupportAssist OS Recovery suffers from a symbolic link attack vulnerability that can be exploited by attackers to cause arbitrary file deletion a...

F5 BIG-IP Remote Command Injection Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. F5 BIG-IP suffers from a remote command injection vulnerability that stems from the application failing to properly filter...

Huawei HarmonyOS media library module privilege checksum vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege checking vulnerability exists in the Huawei HarmonyOS media library module, which can be exploited by an attacker to compromise confidentiality...

D-Link DIR-823X Null Pointer Dereference Vulnerability

The D-Link DIR-823X is a wireless router from China's AUO D-Link. The D-Link DIR-823X suffers from a null pointer dereference vulnerability that originates in the parameter macList in the setwifiblacklists function of the file /goform/setwifiblacklists in the component HTTP POST request handler,...

F5 BIG-IP Denial of Service Vulnerability (CNVD-2025-07325)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A security vulnerability exists in the F5 BIG-IP that originates when SNMP v1 or v2c is disabled and can be exploited by an...

IBM ApplinX Encryption Issue Vulnerability

IBM ApplinX is an International Business Machines IBM company focused on converting green screen interfaces into modern web-based applications. A cryptographic issue vulnerability exists in IBM ApplinX version 11.1 that stems from not properly enabling HTTP strict transport. An attacker could...

NETGEAR FVS336G Command Injection Vulnerability

The NETGEAR FVS336G is a VPN Virtual Private Network firewall router from NETGEAR. The NETGEAR FVS336G suffers from a command injection vulnerability. The vulnerability stems from the application failing to properly filter constructed command special characters, commands, and so on. An attacker...

Google Chrome memory misreference vulnerability (CNVD-2025-12382)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a memory misreference vulnerability that is due to free usage in V8. An attacker can exploit the vulnerability to execute arbitrary code on the system...

Dell Update Manager Plugin Cross-Site Scripting Vulnerability

Dell Update Manager Plugin is an update management plugin from Dell USA. The Dell Update Manager Plugin suffers from a cross-site scripting vulnerability that originates from improperly neutralized HTML tags, which can be exploited by an attacker to cause information disclosure...

Unspecified Vulnerability in IBM ApplinX

IBM ApplinX is an International Business Machines IBM company focused on converting green screen interfaces into modern web-based applications. A security vulnerability exists in IBM ApplinX. An attacker exploiting the vulnerability could hijack a victim's click-to-operate...

Unknown Vulnerability in JetBrains YouTrack

JetBrains YouTrack is a project management tool developed by the Czech company JetBrains that supports cloud hosting and local deployment. JetBrains YouTrack suffers from a security vulnerability that stems from account takeover via spoofed emails and Helpdesk integration. No details of the...

F5 BIG-IP Next Central Manager Input Validation Error Vulnerability

F5 BIG-IP Next Central Manager is a centralized console from F5 USA. An input validation error vulnerability exists in F5 BIG-IP Next Central Manager, which stems from mishandling of API requests, and can be exploited by an attacker to cause termination of the Kubernetes service via an undisclose...

F5 BIG-IP AFM Denial of Service Vulnerability (CNVD-2025-07319)

F5 BIG-IP AFM is an advanced firewall product from F5 USA for protection against DDos attacks. A denial of service vulnerability exists in F5 BIG-IP AFM, which stems from a misconfiguration of protocol checks and can be exploited by an attacker to cause an increase in CPU resource utilization...

Unspecified Vulnerability in Open5GS (CNVD-2025-18580)

Open5GS is Open5GS open source an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. Open5GS has a security vulnerability that can be exploited by attackers to cause a denial of service...

Open5GS has an unspecified vulnerability (CNVD-2025-18579)

Open5GS is Open5GS open source an open source implementation in C of 5G Core and Epc, the core network of the Lte/Nr network. Open5GS has a security vulnerability that can be exploited by attackers to cause a denial of service...

Huawei HarmonyOS interpreter string module out-of-bounds read vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An out-of-bounds read vulnerability exists in the Huawei HarmonyOS interpreter string module, which can be exploited by an attacker to cause availability to ...

F5 BIG-IP APM Access Profile Vulnerability

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. An access profile vulnerability exists in F5 BIG-IP APM that can be exploited by an attacker to cause the Traffic Management Microkernel TMM t...

Cisco Expressway Series Cross-Site Scripting Vulnerability

Cisco Expressway Series is a software from Cisco USA for accessing devices outside the firewall. The software provides simple, highly secure access for users outside the firewall, helping telecommuters work more efficiently on the devices of their choice. A cross-site scripting vulnerability exis...

JetBrains TeamCity Permission Issues Vulnerability

JetBrains TeamCity is a powerful continuous integration and continuous delivery CI/CD tool developed by JetBrains. JetBrains TeamCity suffers from a privilege issue vulnerability that originates from decrypting connection secrets without proper privileges by testing the connection endpoint. No...

Dell Avamar Access Token Reuse Vulnerability

Dell Avamar is a data backup and recovery solution from Dell that focuses on providing organizations with efficient and flexible data protection services that support physical, virtual and cloud environments. Dell Avamar suffers from an access token reuse vulnerability that stems from the inclusi...

JetBrains YouTrack Log Message Disclosure Vulnerability

JetBrains YouTrack is a project management tool developed by JetBrains that supports cloud hosting and local deployment. JetBrains YouTrack suffers from a log information disclosure vulnerability that stems from the fact that persistent tokens can be exposed in logs. An attacker can exploit this...

IBM Aspera Shares Server-Side Request Forgery Vulnerability

IBM Aspera Shares is a Web application from International Business Machines IBM. IBM Aspera Shares suffers from a server-side request forgery vulnerability that stems from the server not implementing an adequate authentication mechanism to confirm the origin of a request, which could be exploited...

Online Birth Certificate System /user/certificate-form.php file cross-site scripting vulnerability

Online Birth Certificate System is an online birth certificate system. Online Birth Certificate System suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in /user/certificate-form.php, which can be exploited by...

Unspecified Vulnerability in CMSimple (CNVD-2026-00537)

CMSimple is a free content management system. An unspecified vulnerability exists in CMSimple, which can be exploited by an attacker to edit the log.php file via the print page...

Unspecified vulnerability in Tencent QQMail (CNVD-2025-06479)

Tencent QQMail is a mailbox software of China Tencent Tencent. An unspecified vulnerability exists in Tencent QQMail, which can be exploited by attackers to access sensitive user information...

CMSimple Insecure Privilege Vulnerability

CMSimple is a PHP and HTML based content management system that helps users to quickly create simple and easy to use websites. CMSimple suffers from an insecure privilege vulnerability that can be exploited by an attacker to obtain sensitive information via a carefully crafted script to download...

mySCADA myPRO Cross-Site Request Forgery Vulnerability

mySCADA myPRO is a professional HMI/SCADA system from mySCADA designed for the visualization and control of industrial processes. A cross-site request forgery vulnerability exists in mySCADA myPRO that stems from not properly validating a request. An attacker could exploit this vulnerability to...

Huawei HarmonyOS UI Framework Module Log Message Improper Control Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. An improperly controlled log message vulnerability exists in the Huawei HarmonyOS UI framework module, which can be exploited by an attacker to compromise...