1036 matches found
react2shell
React2Shell - CVE-2025-55182 Exploit PoC A proof-of-concept exploit for CVE-2025-55182, a critical Remote Code Execution vulnerability in Next.js applications using React Server Components. ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY. ❌ DO NOT use against system...
CVE-2026-51701
Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51687
Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51679
TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setPasswordCfg function. An unauthenticated remote attacker can change the administrator account password by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability is rated ...
EUVD-2026-68675
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51716
Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to delete port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
EUVD-2026-68581
Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51737
Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51646
Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51614
An incorrect access control flaw in the getAccessDeviceCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated attacker on the adjacent network to disclose access-device policy and client state information by sending a crafted POST request to /cgi-bin/cst...
CVE-2026-51640
CVE-2026-51640 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getMeshNeighborTable function allows an unauthenticated attacker on the adjacent network to obtain mesh neighbor information by sending a crafted POST request to /cgi-bin...
CVE-2026-51627
TOTOLINK T6 (version 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the getIptvCfg function, accessible via a crafted POST request to /cgi-bin/cstecgi.cgi. An unauthenticated attacker can obtain IPTV and IGMP configuration information , yielding a high confidentiality impact ...
CVE-2026-51622
CVE-2026-51622 is an incorrect access control vulnerability in the getWanCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can obtain WAN configuration data by sending a crafted POST request to /cgi-bin/cstecgi.cgi . The vulnerability is rated C...
EUVD-2026-67121
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted POST request...
CVE-2026-59233 Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...
CVE-2026-15996
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameter...
EUVD-2026-52339
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...
Linux Distros Unpatched Vulnerability : CVE-2026-53433
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fzf is vulnerable to a Denial of Service DoS due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated...