CVE-2025-15257

A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function formRoute of the file /gogorm/formRoute of the component Web-based Configuration Interface. The manipulation of the argument strIp/strMask/strGateway results in command injection. The...

CVE-2025-15256 Edimax BR-6208AC Web-based Configuration formStaDrvSetup command injection

A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web-based Configuration Interface. The manipulation of the argument rootAPmac leads to command injection. Remote exploitation of the attack i...

CVE-2025-15256 Edimax BR-6208AC Web-based Configuration formStaDrvSetup command injection

A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web-based Configuration Interface. The manipulation of the argument rootAPmac leads to command injection. Remote exploitation of the attack i...

CVE-2025-15252

Affected product: Tenda M3, version 1.0.0.13(4903). Vulnerable component: function formSetRemoteDhcpForAp in /goform/setDhcpAP. Root cause: manipulation of arguments startip, endip, leasetime, gateway, dns1, dns2 leads to a stack-based buffer overflow. Impact: remote attacker can trigger the over...

CVE-2025-15245

A vulnerability was found in D-Link DCS-850L 1.02.09. Affected is the function uploadfirmware of the component Firmware Update Service. The manipulation of the argument DownloadFile results in path traversal. The attack must originate from the local network. The exploit has been made public and...

WordPress User Submitted Posts plugin open to redirection vulnerability

WordPress User Submitted Posts plugin is a WordPress plugin that allows website visitors to submit post content via a front-end form that includes features such as title, tags, categories, author information, URL, body text and image uploads. WordPress User Submitted Posts plugin suffers from an...

PT-2025-54198

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC versions 1.02 through 1.03 Description A security flaw exists in the Web-based Configuration Interface component of Edimax BR-6208AC. The formRoute function within the /gogorm/formRoute file is susceptible to command injection...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992449)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992449 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after failed write When buffered write fails to copy data into...

PT-2025-54206

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC versions 1.02 through 1.03 Description A flaw exists in the Web-based Configuration Interface component of Edimax BR-6208AC versions 1.02 and 1.03. This issue is related to the formALGSetup function within the...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992498)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992498 advisory. In the Linux kernel, the following vulnerability has been resolved: spmi: trace: fix stack-out-of-bound access in SPMI tracing functions tracespmiwritebegin and...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992268)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992268 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Deallocate EPC memory on dwpcieepinit errors If dwpcieepinit fails to perform any actio...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-992611)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992611 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after failed write When buffered write fails to copy data into...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992439)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992439 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetrbtree: fix overlap expiration walk The lazy gc on insert that should remove...

PT-2025-54192

A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web-based Configuration Interface. The manipulation of the argument rootAPmac leads to command injection. Remote exploitation of the attack i...

EUVD-2025-205605

Meshtastic is an open source mesh networking solution. The Meshtastic firmware starting from version 2.5 introduces asymmetric encryption PKI for direct messages, but when the pkiencrypted flag is missing, the firmware silently falls back to legacy AES-256-CTR channel encryption. This was an...

CVE-2025-15194 D-Link DIR-600 HTTP Header hedwig.cgi stack-based overflow

A vulnerability was found in D-Link DIR-600 up to 2.15WWb02. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi of the component HTTP Header Handler. The manipulation of the argument Cookie results in stack-based buffer overflow. It is possible to launch the attack...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2025-992142)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992142 advisory. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not be used to locate the ZIP64 EOCD...

CISA Flags Actively Exploited Digiever NVR Vulnerability Allowing Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency CISA added a security flaw impacting Digiever DS-2105 Pro network video recorders NVRs to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2023-52163 CVSS score: 8.8...

SUSE CVE-2023-54060

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set end correctly when doing batch carry Even though the test suite covers this it somehow became obscured that this wasn't working. The test iommufdioas.mockdomain.accessdomaindestory would blow up rarely. end should be...

SUSE CVE-2023-54116

In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-generic: prohibit potential out-of-bounds access The fbdev test of IGT may write after EOF, which lead to out-of-bound access for drm drivers with fbdev-generic. For example, run fbdev test on a x86+ast2400 platform, wi...