Archive
June 2025
Vulnerabilities first published in this month (UTC), newest first.
1,610 results · Clear filters · Feed
-
Medium 6.3CVE-2025-5441 EPSS 14%
Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 setDeviceURL os command injection
A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function setDeviceURL of the file /goform/setDeviceURL. The m…
-
Medium 6.3
Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 NTP os command injection
A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function NTP of the file /goform/NTP. The manipulation of the argument…
-
Medium 6.3
Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 verifyFacebookLike os command injection
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been rated as critical. Affected by this issue is the function verifyFacebookLike of the file /goform/verify…
-
Medium 6.3CVE-2025-5438 EPSS 26%
Linksys RE6500/RE6250/RE6300/RE6350/RE7000/RE9000 WPS command injection
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been declared as critical. Affected by this vulnerability is the function WPS of the file /goform/WPS. The m…
-
Medium 5.3
Multilaser Sirius RE016 Password Change cstecgi.cgi improper authentication
A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Password Change Handler. The manipulation leads to improper authentication. It is possib…
-
Medium 5.3
Multilaser Sirius RE016 cstecgi.cgi information disclosure
A vulnerability was found in Multilaser Sirius RE016 MLT1.0. It has been rated as problematic. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi. The manipulation leads to information disclosure. The attack may be initiated remotely.…
-
Medium 4.3
A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacke…
-
Medium 6.3
Fengoffice Feng Office index.php sql injection
A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php?c=account&a=set_timezone. The manipulation of the argument tz_offset leads to sql injection. Th…
-
Medium 4.3
WAGO: Switches affected by year 2k38 problem
A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.
-
Medium 6.3
AssamLook CMS view_tender.php sql injection
A vulnerability has been found in AssamLook CMS 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /view_tender.php. The manipulation of the argument ID leads to sql injection. The attack can be launched rem…
-
Medium 4.1
WP-Optimize < 4.2.0 - Admin+ SQLi
The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurati…
-
Medium 4.8
Real Cookie Banner < 5.1.6 - Admin+ Stored XSS
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Store…
-
Medium 6.3
AssamLook CMS department-profile.php sql injection
A vulnerability, which was classified as critical, was found in AssamLook CMS 1.0. Affected is an unknown function of the file /department-profile.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. T…
-
Medium 6.3
AssamLook CMS product.php sql injection
A vulnerability, which was classified as critical, has been found in AssamLook CMS 1.0. This issue affects some unknown processing of the file /product.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The …
-
Medium 6.3
juzaweb CMS Plugins Page install access control
A vulnerability classified as critical was found in juzaweb CMS up to 3.4.2. This vulnerability affects unknown code of the file /admin-cp/plugin/install of the component Plugins Page. The manipulation leads to improper access controls. The attack can be init…
-
Medium 6.3
juzaweb CMS Error Logs Page log-viewer access control
A vulnerability classified as critical has been found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/log-viewer of the component Error Logs Page. The manipulation leads to improper access controls. It is possible to initiate th…
-
Medium 6.3
juzaweb CMS Permalinks Page permalinks access control
A vulnerability was found in juzaweb CMS up to 3.4.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin-cp/permalinks of the component Permalinks Page. The manipulation leads to improper access controls. Th…
-
Medium 6.3
juzaweb CMS Menu Page menus access control
A vulnerability was found in juzaweb CMS up to 3.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin-cp/menus of the component Menu Page. The manipulation leads to improper access controls. The …
-
Medium 6.3
juzaweb CMS Theme Editor Page default access control
A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor Page. The manipulation leads to improper access controls. It is …
-
Medium 6.5
In ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of s…
-
Medium 5.5
In Bluetooth driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of …
-
Medium 5.5
In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of s…
-
Medium 5.5
In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of s…
-
Medium 5.5
In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of s…
-
Medium 6.3
juzaweb CMS Media Page media access control
A vulnerability was found in juzaweb CMS up to 3.4.2 and classified as critical. This issue affects some unknown processing of the file /admin-cp/media of the component Media Page. The manipulation leads to improper access controls. The attack may be initiate…
-
Medium 6.3
juzaweb CMS General Setting Page general access control
A vulnerability has been found in juzaweb CMS up to 3.4.2 and classified as critical. This vulnerability affects unknown code of the file /admin-cp/setting/system/general of the component General Setting Page. The manipulation leads to improper access control…
-
Medium 4.3
juzaweb CMS Email Logs Page email access control
A vulnerability, which was classified as problematic, was found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/logs/email of the component Email Logs Page. The manipulation leads to improper access controls. It is possible to i…
-
Medium 6.3
juzaweb CMS Plugin Editor Page editor access control
A vulnerability, which was classified as critical, has been found in juzaweb CMS up to 3.4.2. Affected by this issue is some unknown functionality of the file /admin-cp/plugin/editor of the component Plugin Editor Page. The manipulation leads to improper acce…
-
Medium 5.9
A Local File Inclusion (LFI) vulnerability exists in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before, w…
-
Medium 6.5
Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials.
-
Medium 6.1
A Cross Site Scripting (XSS) vulnerability in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before allows an…
-
Medium 6.5
Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout an…
-
Medium 6.5
An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execu…
-
Medium 6.5
An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execu…
-
Medium 5.4
osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php.
-
Medium 6.5
Tenda AC6 V15.03.05.16 was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement…
-
Medium 5.4
A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config…
-
Medium 6.5
An issue was discovered in Samsung Mobile Processor Exynos 2200. A Use-After-Free in the mobile processor leads to priv…
-
Medium 6.4
Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a…
-
Medium 4.3
Arris VIP1113 devices through 2025-05-30 with KreaTV SDK have a firmware decryption key of cd1c2d78f2cba1f73ca7e697b4a4…