CVE Vulnerability Catalog

A vulnerability was determined in Belkin F9K1015 1.00.10, involving command injection in /goform/formSetWanStatic. Manipulation of m_wan_ipaddr allows remote command execution. The exploit is publicly disclosed.

Wykryto podatność w urządzeniu Belkin F9K1015 w wersji 1.00.10, która dotyczy nieznanego przetwarzania pliku /goform/formSetLanguage. Manipulacja argumentem webpage prowadzi do przepełnienia bufora, co może być zdalnie wykorzystane przez atakującego.

A vulnerability has been found in Belkin F9K1015 1.00.10. This vulnerability affects unknown code in /goform/formPPTPSetup, where manipulation of the pptpUserName argument leads to buffer overflow. The attack can be executed remotely, and the exploit has been disclosed publicly.

A flaw has been found in Belkin F9K1015 1.00.10. This affects an unknown part of /goform/formPPPoESetup, where manipulation of the pppUserName argument causes buffer overflow. Remote exploitation is possible, and the exploit has been published.

A vulnerability was detected in Belkin F9K1015 1.00.10. The issue affects an unknown function in /goform/formL2TPSetup, where manipulation of the L2TPUserName argument leads to buffer overflow. The attack can be launched remotely, and the exploit is publicly available.

A security vulnerability has been detected in Belkin F9K1015 1.00.10. Affected by this vulnerability is an unknown functionality in /goform/formConnectionSetting, where manipulation of the max_Conn argument leads to buffer overflow. The attack may be initiated remotely, and the exploit has been disclosed publicly.

A weakness was identified in Belkin F9K1015 1.00.10, involving command injection in /goform/formBSSetSitesurvey. Manipulation of wan_ipaddr allows remote command execution. The exploit is publicly available.

ixmaps website2017 up to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0 has an XSS vulnerability in /map.php within the HTTP GET Request Handler. Manipulating the trid argument results in cross-site scripting.

In allegroai/clearml version v2.0.1, there is a path traversal vulnerability due to improper handling of symbolic and hard links in the `safe_extract` function. This can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution.

A vulnerability was found in CicadasCMS (up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab) in the Save function of TemplateFileServiceImpl.java, within the template management component. The cross-site scripting (XSS) flaw allows remote exploitation. The exploit has been publicly disclosed and may be used.

Zidentyfikowano podatność w samanhappy MCPHub do wersji 0.9.10, która dotyczy funkcji handleSseConnection w pliku src/services/sseService.ts. Manipulacja tą funkcją prowadzi do niewłaściwej autoryzacji.

In samanhappy MCPHub up to version 0.9.10, there is a server-side request forgery (SSRF) vulnerability in the file src/controllers/serverController.ts of the MCPRouter Service component, caused by manipulation of the baseUrl argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability was found in MCPHub up to 0.9.10, involving OS command injection in src/controllers/serverController.ts. Manipulation of command/args allows remote code execution. The exploit is public and may be used.

W systemie Zytec Dalian Zhuoyun Technology Central Authentication Service 3 odkryto podatność, która dotyczy nieznanej funkcjonalności pliku /index.php/auth/Ops/git w komponencie HTTP Header Handler. Manipulacja argumentem Authorization prowadzi do wykorzystania twardo zakodowanego hasła.

A vulnerability was determined in Frappe LMS 2.35.0 affecting an unknown function of the Course Handler component. Manipulation of the Description argument can lead to cross-site scripting (XSS). The attack can be executed remotely, and the exploit has been publicly disclosed and may be utilized.

A vulnerability in Frappe LMS 2.34.x/2.35.0 concerns an incomplete fix for CVE-2025-55006. Manipulation of an unknown function leads to cross-site scripting (XSS). The attack can be performed remotely, and the exploit is publicly available.

A vulnerability has been found in Frappe LMS 2.35.0 in an unknown function of the /files/ file of the Assignment Picture Handler component. The manipulation causes a direct request that can be initiated remotely. The attack complexity is rated as high and exploitability as difficult, but the exploit has been publicly disclosed and may be used.

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. It affects unknown processing in the Add Work Item Page component, where manipulation of the Title argument results in CSV injection. The attack can be launched remotely, and the exploit is now public.

A cross-site scripting vulnerability has been detected in AllStarLink Supermon up to version 6.2, affecting the AllMon2 component. The attack can be initiated remotely, and the exploit has been publicly disclosed. The product is no longer supported by the maintainer.