VulnCheck KEV: CVE-2025-7414

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.123880. This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely...

OESA-2025-2279 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: A denial-of-service vulnerability has been identified in the libso...

The vulnerability of the tcpcheck_net function in the microprogramming software of the TOTOLink T6 system allows a intruder to execute arbitrary code.

The vulnerability of the tcpchecknet function in the microprogramming software of the TOTOLink T6 system arises from the lack of measures taken at the control level during the processing of the domain parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending...

The vulnerability of the tcpcheck_net function in the microprogramming software of the TOTOLink T6 system allows a intruder to execute arbitrary code.

The vulnerability of the tcpchecknet microprogramming software used in the TOTOLink T6 mesh system lies in the lack of measures taken to protect data at the management level when processing the domain parameter. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

Axelor 安全漏洞

Axelor is a modular development framework from the French company Axelor. A security vulnerability exists in Axelor version 5.2.4, which stems from a Boolean SQL injection in the domain parameter and could lead to a data leak...

Tenda O3V2 /goform/setPingInfo file command injection vulnerability

Tenda O3V2 is an outdoor wireless bridge from Tenda, China. Tenda O3V2 suffers from a command injection vulnerability, which originates from the parameter domain in the file /goform/setPingInfo failing to correctly filter constructed command special characters, commands, etc. The vulnerability is...

CVE-2025-7414

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.123880. This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely...

Tenda O3V2 命令注入漏洞

Tenda O3V2 is an outdoor wireless bridge from Tenda, China. Tenda O3V2 suffers from a command injection vulnerability, which originates from the parameter domain in the file /goform/setPingInfo failing to correctly filter constructed command special characters, commands, etc. The vulnerability is...

CVE-2025-34087: Improper Neutralization of Special Elements used in an OS Command

An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain parameter is not properly sanitized, allowing an attacker to append OS commands to the domain string. These commands are executed on the...

CVE-2023-31664

A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter...

CVE-2023-44018

Tenda AC10U v1.0 USAC10UV1.0RTLV15.03.06.49multiTDE01 was discovered to contain a stack overflow via the domain parameter in the addwhitenode function...

CVE-2021-43459

A Cross Site Scripting XSS vulnerability exists in Rumble Mail Server 0.51.3135 via the 1 domain and 2 path parameters...

SUSE CVE-2025-4476

A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 Unauthorized HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed...

CVE-2025-4476

A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 Unauthorized HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed...

DEBIAN-CVE-2025-4476

A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 Unauthorized HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed...

UBUNTU-CVE-2025-4476

A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 Unauthorized HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed...

TOTOLINK A950RG和TOTOLINK A810R 安全漏洞

TOTOLINK A950RG and TOTOLINK A810R are both products of China's Gion Electronics TOTOLINK.TOTOLINK A950RG is a super-generation Giga wireless router.TOTOLINK A810R is a wireless dual-band router. A command execution vulnerability exists in the TOTOLINK A950RG and TOTOLINK A810R, which stems from...

FoxCMS 安全漏洞

FoxCMS is a free commercial open source content management system from China Qianhuox FoxCMS company. A security vulnerability exists in FoxCMS 1.25 and earlier versions, which stems from insufficient filtering of the urlprefix, domain and mywebsite parameters in the installdb.php file, which may...

The vulnerability of the formModifyDnsForward() function in Tenda W15E router microprogramming software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the formModifyDnsForward function in the Tenda W15E router’s microprogramming software is related to the issue of the operation going beyond the buffer in memory when processing the DNSDomainName parameter. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2023-40143

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...