CVE-2026-6559

🗓️ 19 Apr 2026 05:15:15Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 7 Views🌐 WEB

CVE-2026-6559: Wavlink WL-WN579A3 login.cgi sub_401F80 enables cross site scripting; upgrade.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-6559	19 Apr 202605:15	–	attackerkb
Circl	CVE-2026-6559	19 Apr 202609:49	–	circl
CNNVD	WAVLINK WL-WN579A3 安全漏洞	19 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-6559 Wavlink WL-WN579A3 login.cgi sub_401F80 cross site scripting	19 Apr 202605:15	–	cvelist
EUVD	EUVD-2026-23682	19 Apr 202606:31	–	euvd
NVD	CVE-2026-6559	19 Apr 202606:16	–	nvd
Positive Technologies	PT-2026-33617	19 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-6559	20 Apr 202619:23	–	redhatcve
Vulnrichment	CVE-2026-6559 Wavlink WL-WN579A3 login.cgi sub_401F80 cross site scripting	19 Apr 202605:15	–	vulnrichment

Vulners

Node

wavlink wl-wn579a3Match220323

[
  {
    "vendor": "Wavlink",
    "product": "WL-WN579A3",
    "versions": [
      {
        "version": "220323",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:o:wavlink:wl-wn579a3_firmware:*:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/submit/785303
vuldb	www.vuldb.com/vuln/358196
github	www.github.com/Litengzheng/vul_db/blob/main/WL-WN579A3/vul_16/README.md
dl	www.dl.wavlink.com/firmware/RD/WINSTAR_WN579A3-A-2026-03-10-94f93d4-WO-mt7628-squashfs-sysupgrade.bin
vuldb	www.vuldb.com/vuln/358196/cti

Parameter	Position	Path	Description	CWE
Hostname	query param	/cgi-bin/login.cgi	Hostname parameter can be manipulated to trigger cross-site scripting (XSS) in the login.cgi handler.	CWE-94, CWE-79

22 Apr 2026 20:22Current

4.5Medium risk

Vulners AI Score4.5

CVSS 3.14.3

CVSS 25

CVSS 45.3

CVSS 34.3

EPSS0.00039

SSVC