Tenda AC10 security vulnerabilities

Tenda AC10 is a dual-band Gigabit wireless router launched by Shenzhen Jixiang Tenda Technology Co., Ltd, mainly for 200M and above fiber optic users. Tenda AC10 suffers from an improper access control vulnerability, which originates from improper access control of the /goform/ate endpoint, and c...

CVE-2025-57219

Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09multiTDE01 allows attackers to escalate privileges or access sensitive components via a crafted request...

WordPress plugin BlogMarks has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-58192

Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bulk Delete: from n/a through = 1.3.6...

Linux Distros Unpatched Vulnerability : CVE-2023-3431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9. CVE-2023-3431 Note that Nessus relies on the presence of the package as report...

Linux Distros Unpatched Vulnerability : CVE-2019-12441

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access control issue which...

Citrix Patches Three NetScaler Flaws, Confirms Active Exploitation of CVE-2025-7775

Citrix has released fixes to address three security flaws in NetScaler ADC and NetScaler Gateway, including one that it said has been actively exploited in the wild. The vulnerabilities in question are listed below - CVE-2025-7775 CVSS score: 9.2 - Memory overflow vulnerability leading to Remote...

CVE-2025-25733

Incorrect access control in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units RSUs v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows physically proximate attackers to arbitrarily modify SPI flash regions, leading to a degradation of the security posture of the devi...

CVE-2025-1501

An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can request and download...

CVE-2025-1501

The CVE-2025-1501 vulnerability affects Nozomi Networks Guardian/CMC prior to v25.1.0, where improper access controls in the Request Trace and Download Trace features allow an authenticated user with limited privileges to request and download trace files, potentially exposing unauthorized network...

CVE-2025-25733

The Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) are affected by an incorrect access control issue in the SPI Flash Chip . This vulnerability affects versions v3.2.0.829.23 , v3.8.0.1119.42 , and v4.6.0.1211.28 . A physically proximate attacker can exploit this flaw to arbitrarily ...

CVE-2025-29524

Incorrect access control in the component /cgi-bin/systemdiagnosticmain.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to access sensitive information...

CVE-2025-29515

Incorrect access control in the DELTfile.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password...

CVE-2025-29515

Incorrect access control in the DELTfile.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password...

CVE-2025-29524

Incorrect access control in the component /cgi-bin/systemdiagnosticmain.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to access sensitive information...

CVE-2025-29515

The D-Link DSL-7740C router, running firmware version DSL7740C.V6.TR069.20211230 , is vulnerable to an improper access control flaw in the DELT_file.xgi API endpoint. This vulnerability allows a remote attacker to read, modify, delete data, and alter various device settings within the device's XM...

CVE-2024-46412

Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-location...

CVE-2025-29520

The D-Link DSL-7740C modem (firmware DSL7740C.V6.TR069.20211230 ) contains an incorrect access control vulnerability within its Maintenance module . This flaw allows authenticated attackers with low-level privileges to arbitrarily change high-privileged account passwords, leading to privilege esc...

CVE-2025-44178

DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings. Attackers can exploit this vulnerability to gain unauthorized access to sensitive information and modify its configuration via the UPnP protocol WAN sides without any authentication...

D-Link DSL-7740C security vulnerabilities

The D-Link DSL-7740C is a modem from China-based AUO D-Link. An access control error vulnerability exists in the D-Link DSL-7740C DSL7740C.V6.TR069.20211230 version, which stems from improper access control of the DELTfile.xgi endpoint, and can be exploited by an attacker to modify arbitrary...