CVE-2025-30039: Missing Authentication for Critical Function

Unauthenticated access to the "/cgi-bin/CliniNET.prd/GetActiveSessions.pl" endpoint allows takeover of any user session logged into the system, including users with admin privileges...

Linux Distros Unpatched Vulnerability : CVE-2023-46586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 before 1.0 lacks '\0' termination of the path for CGI scripts because strncpy is misused. CVE-2023-46586 Note that...

PT-2025-34954 · D Link · D-Link Dir-645 +6

Name of the Vulnerable Software and Affected Versions: D-Link DIR-110 version 1.03 D-Link DIR-412 version 1.03 D-Link DIR-600 version 1.03 D-Link DIR-610 version 1.03 D-Link DIR-615 version 1.03 D-Link DIR-645 version 1.03 D-Link DIR-815 version 1.03 Description: Multiple D-Link DIR-series router...

CVE-2025-30040: Missing Authentication for Critical Function

The vulnerability allows unauthenticated users to download a file containing session ID data by directly accessing the "/cgi-bin/CliniNET.prd/utils/userlogxls.pl" endpoint...

PT-2025-34808 · Ipfire · Ipfire

Name of the Vulnerable Software and Affected Versions: IPFire version 2.29 Description: The web-based firewall interface firewall.cgi fails to sanitize several rule parameters, including PROT, SRC PORT, TGT PORT, dnatport, key, ruleremark, src addr, std net tgt, and tgt addr. This allows an...

CVE-2025-29524: Improper Access Control

Incorrect access control in the component /cgi-bin/systemdiagnosticmain.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to access sensitive information...

Linux Distros Unpatched Vulnerability : CVE-2016-4561

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in the cgierror function in CGI.pm in ikiwiki before 3.20160506 might allow remote attackers to inject arbitrary web scri...

VulnCheck KEV: CVE-2021-28150

Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf with the administrator password and other sensitive data via /backup2.cgi...

VulnCheck KEV: CVE-2024-48074

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...

CVE-2025-9149

A vulnerability was determined in Wavlink WL-NU516U1 M16U1V240425. This impacts the function sub4032E4 of the file /cgi-bin/wireless.cgi. This manipulation of the argument Guestssid causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclose...

CVE-2009-10005

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output...

The vulnerability of the setLanguageCfg() function in the TOTOLINK EX1200T router’s microprogramming software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setLanguageCfg function /cgi-bin/cstecgi.cgi of the TOTOLINK EX1200T router software arises from operations that go beyond the buffer limits in memory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and...

CVE-2009-10005: Files or Directories Accessible to External Parties

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output...

The vulnerability of the setWiFiMeshName function in the TOTOLink T10 mesh system, which allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setWiFiAclRules function /cgi-bin/cstecgi.cgi in the TOTOLink T10 mesh system is caused by buffer overflow. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the confidentiality, integrity, and accessibility of the protected...

CVE-2025-9149: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in Wavlink WL-NU516U1 M16U1V240425. This impacts the function sub4032E4 of the file /cgi-bin/wireless.cgi. This manipulation of the argument Guestssid causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclose...

CVE-2025-8949

A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function getpingappstat of the file pingresponse.cgi of the component httpd. The manipulation of the argument pingipaddr leads to stack-based buffer overflow. The attack can be launched remotely. The...

The vulnerability of the `bs_GetHostInfo` function in the `libblinkapi.so` library, located in the `/cgi-bin/lighttpd.cgi` file of the LB-LINK router software, allows a hacker to disclose protected information.

The vulnerability of the bsGetHostInfo function in the libblinkapi.so library, located in the /cgi-bin/lighttpd.cgi file of the LB-LINK router software, is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker to disclose sensitive informati...

The vulnerability of the fileupload-cgi CGI script of the Zyxel networking devices allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the fileupload-cgi CGI script of the Zyxel networking device lies in an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2025-50615

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN00470c50 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wlmacfilterset in the payload, which can cause the program to crash and lead to a Denial of...

CVE-2025-50611

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN00473154 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wlsecset5g and wlsecrpset5g in the payload, which can cause the program to crash and potentially...