CVE-2026-4166

🗓️ 15 Mar 2026 05:32:08Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 7 Views🌐 WEB

CVE-2026-4166: Wavlink WL-NU516U1 login.cgi sub_404F68 enables remote cross site scripting.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-4166	15 Mar 202605:32	–	attackerkb
CNNVD	WAVLINK WL-NU516U1 代码注入漏洞	16 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-4166 Wavlink WL-NU516U1 login.cgi sub_404F68 cross site scripting	15 Mar 202605:32	–	cvelist
EUVD	EUVD-2026-12208	16 Mar 202615:30	–	euvd
NVD	CVE-2026-4166	16 Mar 202614:19	–	nvd
Positive Technologies	PT-2026-25540	15 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-4166	26 Mar 202615:15	–	redhatcve
Vulnrichment	CVE-2026-4166 Wavlink WL-NU516U1 login.cgi sub_404F68 cross site scripting	15 Mar 202605:32	–	vulnrichment

Vulners

Node

wavlink wl-nu516u1Match240425

[
  {
    "vendor": "Wavlink",
    "product": "WL-NU516U1",
    "versions": [
      {
        "version": "240425",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
github	www.github.com/Litengzheng/vul_db/blob/main/WL-NU516U1/vul_14/README.md
github	www.github.com/Litengzheng/vul_db/blob/main/WL-NU516U1/vul_15/README.md
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
homepage	query param	cgi-bin/login.cgi	Cross-site scripting via manipulation of homepage/hostname in /cgi-bin/login.cgi	CWE-94, CWE-79
hostname	query param	cgi-bin/login.cgi	Cross-site scripting via manipulation of homepage/hostname in /cgi-bin/login.cgi	CWE-94, CWE-79

17 Jun 2026 10:56Current

4.1Medium risk

Vulners AI Score4.1

CVSS 3.13.5

CVSS 24

CVSS 45.1

CVSS 33.5

EPSS0.00203

SSVC