BRCC Incorrect Access Control vulnerability

Incorrect access control in the /admin/ API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request...

CVE-2025-45615

Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted request...

CVE-2025-45607

An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request...

libsoup: Out of bounds reads in soup_headers_parse_request()

A flaw was found in libsoup, where the soupheadersparserequest function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server...

CVE-2025-45615

Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted request...

CVE-2025-45607

An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request...

CVE-2025-45607

CVE-2025-45607 affects itranswarp v2.19; the issue is in the /manage/ component and allows authentication bypass via a crafted request. Root cause described as improper/auth bypass in that component. CVSS v3.1 base score 9.8 (CRITICAL). Exploitation details are not fully provided in the documents...

CVE-2025-45616

Incorrect access control in the /admin/ API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request...

CVE-2025-45616

Incorrect access control in the /admin/ API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request...

CVE-2025-45616

Incorrect access control in the /admin/ API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request...

CVE-2025-45616

CVE-2025-45616 affects Baidu BRCC v1.2.0, with an incorrect access-control in the /admin/** API that can let an attacker obtain Admin rights via a crafted request. The public records consistently describe the vulnerability as an improper access-control /admin/** exposure, enabling unauthorized ad...

CVE-2025-45615

CVE-2025-45615 affects yaoqishan v0.0.1-SNAPSHOT; the /admin/ API has improper access control that can let an attacker obtain Admin rights via a crafted request. CVSSv3.1 base score 9.8 (CRITICAL). Exploitation details are not provided in the documents beyond a PoC/Exploitation field indicating p...

CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44863

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44877

Tenda AC9 V15.03.06.42multi was found to contain a command injection vulnerability in the formSetSambaConf function via the usbname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44868

Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the pingtest function of the adm.cgi via the pingIp parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44848

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44837

TOTOLINK CPE CP900 V6.3c.1144B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or magicid parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44865

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the enable parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...