12596 matches found
TOTOLINK A8000RU CGI Handler setNtpCfg Command Execution
The vulnerability of the setNtpCfg function in the /cgi-bin/cstecgi.cgi file of the CGI Handler component of the TOTOLINK A8000RU router’s software lies in the lack of measures to neutralize special elements. Exploiting this vulnerability could allow a remote attacker to execute arbitrary command...
Wavlink WL-NU516U1 OTA Arbitrary Command Execution
The vulnerability of the otanewupgrade function in the /cgi-bin/adm.cgi script of the Wavlink WL-NU516U1 wireless USB printer software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow an attacker to execute arbitrary commands...
CVE-2026-15513: Improper Neutralization of Special Elements used in an OS Command
A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlinkucisetvalue of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lanip results in os command injection. The attack can be initiated remotely. The exploit has been released to the...
PT-2026-57579
A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink uci set value of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lan ip results in os command injection. The attack can be initiated remotely. The exploit has been released to th...
Security update for perl-CGI-Session (moderate)
openSUSE Security Update: Security update for perl-CGI-Session Announcement ID: openSUSE-SU-2026:0240-1 Rating: moderate References: 1269983 Cross-References: CVE-2026-56016 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...
CVE-2026-15204 TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal
A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415B20250515/9.1.0cu.2350B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin/cstecgi.cgi of the component OpenVPN Export. The manipulation results in path traversal. The attack may be launched...
D-Link DNS-120 Arbitrary Command Execution
The vulnerability of the /cgi-bin/guimgr.cgi microprogramming software for D-Link devices such as DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and...
D-Link DNS-120 CGI Addgroup Get Group Quota Minsize Buffer Overflow
The vulnerability of the cgiaddgroupgetgroupquotaminsize function in the /cgi-bin/accountmgr.cgi script of the D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4,...
D-Link DNS-120 CGI Set Wto Buffer Overflow
The vulnerability of the cgisetwto function in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 devices is related to errors in privile...
FreeBSD : p5-CGI-Session -- secuity fixes (dfa2ef44-7785-11f1-99fc-40b034429ecf)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the dfa2ef44-7785-11f1-99fc-40b034429ecf advisory. CGI-Session project reports: SECURITY: Strengthen cryptographic randomness of MD5 driver. Tenable has...
Exploit for OS Command Injection in Gnu Bash
Blind-SSRF-to-Remote-Code-Execution-Shellshock-Professional-Bu...
PT-2026-81893
Name of the Vulnerable Software and Affected Versions TOTOLINK N600R version 4.3.0cu.7647 B20210106 Description A stack-based buffer overflow exists in the CGI Handler component. The issue occurs within the setSystemConfig function located in the '/cgi-bin/cstecgi.cgi' endpoint. A remote attacker...
perl-CGI-Session-4.490.0-1.1 on GA media (moderate)
perl-CGI-Session-4.490.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11168-1 Rating: moderate Cross-References: CVE-2026-56016 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
CVE-2026-56016
A flaw was found in perl-CGI-Session. This vulnerability allows a remote attacker to predict session identifiers due to the use of low-entropy sources in the generateid method. By predicting a session identifier, an attacker can impersonate a user's session, leading to a bypass of authentication...
CVE-2026-56016
CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generateid method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand function. All three are predictable, low-entropy sources: the PID i...
CVE-2026-56016
CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generateid method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand function. All three are predictable, low-entropy sources: the PID i...
CVE-2026-56016
CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generateid method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand function. All three are predictable, low-entropy sources: the PID i...
CVE-2026-56016
CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generateid method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand function. All three are predictable, low-entropy sources: the PID i...
CVE-2026-56016
The CGI::Session::ID::md5 component for Perl, in versions prior to 4.49 , is vulnerable to session hijacking due to the generation of predictable session IDs. The generate_id method relies on low-entropy sources, including the process ID (PID), epoch time (which can be inferred from HTTP headers)...