rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-25708 Persistent XSS when creating new application using Web App Builder
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.  The privileges required to execute this attack are high.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Esri
product: ArcGIS Enterprise Web App Builder
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-04-04T17:52:48.621Z
CVE-2024-25709 Self-XSS style in move item dialog
There is a stored Cross‑Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item, which could potentially execute arbitrary JavaScript code in a victim’s browser. Exploitation does not require any privileges and can be performed by an anonymous user.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Esri
product: Portal for ArcGIS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Miguel Falé
Published: 2024-04-04T17:55:17.893Z
CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.
Problem types: cwe_id: CWE-835
description: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: Apache Software Foundation
product: Apache Commons Compress
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Yakov Shafranovich, Amazon Web Services
Published: 2024-02-19T08:33:40.627Z
CVE-2024-25711 
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-11T00:00:00.000Z
CVE-2024-25712 
http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-11T00:00:00.000Z
CVE-2024-25713 
yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-11T00:00:00.000Z
CVE-2024-25714 
In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has constant-time execution.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-11T00:00:00.000Z
CVE-2024-25715 
Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirect_uri.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-11T00:00:00.000Z
CVE-2024-25718 
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-11T00:00:00.000Z
CVE-2024-25722 
qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-11T00:00:00.000Z
CVE-2024-25723 
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-25724 
In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service allows attackers to execute code with the affected service's privileges, compromise the service's integrity, leak sensitive information, or crash the service. These attacks could be done via a remote malicious RTPS message; a compromised call with malicious parameters to the RTI_RoutingService_new, rti::recording::Service, RTI_QueuingService_new, or RTI_CDS_Service_new public APIs; or a compromised local file system containing a malicious XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:L/I:H/PR:L/S:U/UI:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
Published: 2024-05-21T18:38:01.402Z
CVE-2024-25728 
ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends them to DNS servers operated by the user's ISP instead of to the ExpressVPN DNS servers), which may allow remote attackers to obtain sensitive information about websites visited by VPN users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-11T00:00:00.000Z
CVE-2024-25729 
Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last octet.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-07T00:00:00.000Z
CVE-2024-25730 
Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, resulting in insufficient entropy (only about one million possibilities).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-23T00:00:00.000Z
CVE-2024-25731 
The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus, encryption can be defeated by an attacker who can observe packet data (e.g., over Wi-Fi).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-04T00:00:00.000Z
CVE-2024-25734 
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid username is entered, which might make it easier for remote attackers to enumerate user accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2024-25735 
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2024-25736 
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-27T00:00:00.000Z
CVE-2024-25737 
A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T19:05:25.776Z
CVE-2024-25738 
A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remote attacker to overwrite local configuration files to gain access to the administrator panel and achieve Remote Code Execution. A mitigating factor is that it requires the allow_url_include PHP runtime setting to be on, which is off in default installations. It also requires the /Upgrade route to be exposed, which is exposed by default after installing VuFind, and is recommended to be disabled by setting autoConfigure to false in config.ini.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T18:56:47.568Z
CVE-2024-25739 
create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-12T00:00:00.000Z
CVE-2024-25740 
A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj->name is not released.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-12T00:00:00.000Z
CVE-2024-25741 
printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might allow attackers to cause a denial of service or have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-12T00:00:00.000Z
CVE-2024-25742 
In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-17T21:14:08.723Z
CVE-2024-25743 
In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIGFPE signal handler in userspace applications. This affects AMD SEV-SNP and AMD SEV-ES.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-15T17:43:31.216Z
CVE-2024-25744 
In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-12T00:00:00.000Z
CVE-2024-25746 
Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the add_white_node function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-22T00:00:00.000Z
CVE-2024-25748 
A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the fromSetIpMacBind function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-22T00:00:00.000Z
CVE-2024-25751 
A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the fromSetSysTime function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-26T00:00:00.000Z
CVE-2024-25753 
Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the formSetDeviceName function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-22T00:00:00.000Z
CVE-2024-25756 
A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the formWifiBasicSet function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-22T00:00:00.000Z
CVE-2024-25763 
openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-26T00:00:00.000Z
CVE-2024-25767 
nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-26T00:00:00.000Z
CVE-2024-25768 
OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-26T00:00:00.000Z
CVE-2024-25770 
libming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-26T00:00:00.000Z
CVE-2024-25801 
SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name (not the content) of a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-22T00:00:00.000Z
CVE-2024-25802 
SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the file content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-22T00:00:00.000Z
CVE-2024-25807 
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-25808 
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create new album function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-22T00:00:00.000Z
CVE-2024-25811 
An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-29T00:00:00.000Z
CVE-2024-25812 
MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-22T00:00:00.000Z
CVE-2024-25814 
MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-22T00:00:00.000Z
CVE-2024-25817 
Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-05T00:00:00.000Z
CVE-2024-25825 
FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with the root password saved as a wildcard. This allows attackers to gain root access without a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-09T00:00:00.000Z
CVE-2024-25828 
cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-22T00:00:00.000Z
CVE-2024-25830 
F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the root and admin password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-25831 
F-logic DataCube3 Version 1.0 is affected by a reflected cross-site scripting (XSS) vulnerability due to improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-25832 
F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by manipulating the filename extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-25833 
F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-28T00:00:00.000Z
CVE-2024-25837 
A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-16T00:00:00.000Z
CVE-2024-25839 
An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate privileges and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-03T00:00:00.000Z
CVE-2024-25840 
In the module "Account Manager | Sales Representative & Dealers | CRM" (prestasalesmanager) up to 9.0 from Presta World for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-25841 
In the module "So Flexibilite" (soflexibilite) from Common-Services for PrestaShop < 4.1.26, a guest (authenticated customer) can perform Cross Site Scripting (XSS) injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-25842 
An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" (prestasalesmanager) module for PrestaShop before version 9.0, allows remote attackers to escalate privilege and obtain sensitive information via the uploadLogo() and postProcess methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-03T00:00:00.000Z
CVE-2024-25843 
In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-25844 
An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate privileges and obtain sensitive information via debug file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-03T00:00:00.000Z
CVE-2024-25845 
In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-08T00:00:00.000Z
CVE-2024-25846 
In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extensions .php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-27T00:00:00.000Z
CVE-2024-25847 
SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::__construct() and importProducts::_addDataToDb methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-03T00:00:00.000Z
CVE-2024-25848 
In the module "Ever Ultimate SEO" (everpsseo) <= 8.1.2 from Team Ever for PrestaShop, a guest can perform SQL injection in affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-08T00:00:00.000Z
CVE-2024-25849 
In the module "Make an offer" (makeanoffer) <= 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injection via MakeOffers::checkUserExistingOffer()` and `MakeOffers::addUserOffer()` .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-03-08T00:00:00.000Z
CVE-2024-25850 
Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-22T00:00:00.000Z
CVE-2024-25851 
Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter in other_para of cgitest.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-02-22T00:00:00.000Z
CVE-2024-25852 
Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point. An attacker can use the vulnerability to obtain device administrator rights.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-11T00:00:00.000Z