CVE-2026-23604

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Keyword Filtering rule creation workflow. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv1$TXBRuleName parameter to...

CVE-2026-26049

The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, screenshots, or browser form...

CVE-2026-2846

A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command injection. The attack can be initiated...

CVE-2026-2847

A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument IspName results in os command injection. The attack can be launched remotely. The explo...

CVE-2026-2846

A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command injection. The attack can be initiated...

CVE-2026-26049 Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials

The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, screenshots, or browser form...

CVE-2026-25715 Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements

The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all...

CVE-2026-2847 UTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injection

A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument IspName results in os command injection. The attack can be launched remotely. The explo...

CVE-2026-2846 UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection

A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command injection. The attack can be initiated...

CVE-2026-2846 UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection

A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command injection. The attack can be initiated...

CVE-2026-2846

A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command injection. The attack can be initiated...

PT-2026-21023

Name of the Vulnerable Software and Affected Versions UTT HiPER 520 version 1.7.7-160105 Description A security issue exists in UTT HiPER 520. The sub 44D264 function within the /goform/formPdbUpConfig file of the Web Management Interface is susceptible to operating system command injection. This...

PT-2026-21241

The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, screenshots, or browser form...

UTT HiPER 520 操作系统命令注入漏洞

UTT HiPER 520 is a high-performance router produced by UTT Corporation. The version 1.7.7-160105 of UTT HiPER 520 contains a vulnerability related to operating system command injection. This vulnerability stems from an incorrect operation of the parameter IspName in the function sub44EFB4 of the...

PT-2026-21024

Name of the Vulnerable Software and Affected Versions UTT HiPER 520 version 1.7.7-160105 Description A flaw exists in the Web Management Interface component of UTT HiPER 520. Specifically, manipulating the Isp Name argument within the sub 44EFB4 function of the /goform/formReleaseConnect file can...

PT-2026-21239

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The web management interface allows the administrator username and password to be set to blank values. After applying these blank values, the device allows...

The vulnerability of the /cgi-bin/DownloadLog file in the Web Management Interface component of the Tenda AC21 microprogramming router allows a hacker to gain unauthorized access to protected information.

The vulnerability of the /cgi-bin/DownloadLog file of the Web Management Interface component of the Tenda AC21 microprogramming system for routers is related to errors in information processing. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access t...

UTT HiPER 520 操作系统命令注入漏洞

UTT HiPER 520 is a high-performance router produced by UTT Corporation. The version 1.7.7-160105 of UTT HiPER 520 contains a vulnerability related to operating system command injection. This vulnerability stems from an error in the handling of the parameter policyNames in the function sub44D264 o...

CVE-2025-14340

Cross-site scripting in REST Management Interface in Payara Server 4.1.2.191.54, 5.83.0, 6.34.0, 7.2026.1 allows an attacker to mislead the administrator to change the admin password via URL Payload...

CVE-2026-23619

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Local Domains settings page. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$Pv3$txtDescription parameter to /MailEssentials/pages/MailSecurity/general.aspx,...