46486 matches found
CVE-2026-51681
Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51679
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51675
Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51674
Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to configure forced reboot tasks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51678
Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51673
Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51676
Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51677
Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51670
Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to query slave upgrade status and affect upgrade bookkeeping via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51672
Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-19616
creationtimestamp| type| source ---|---|--- 2026-08-31 14:14:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/35vjztok5lmwx 2026-08-31 20:52:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mufryf3o4g2h...
CVE-2026-51666
Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-81693
creationtimestamp| type| source ---|---|--- 2026-08-31 12:02:29+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mueudrrgoe25 2026-09-03 13:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mumkzrd47l2l...
CVE-2026-73511
creationtimestamp| type| source ---|---|--- 2026-08-31 11:57:46+00:00| seen| https://bsky.app/profile/mfahlandt.bsky.social/post/3mueu3drtvg2r...
CVE-2026-82670
creationtimestamp| type| source ---|---|--- 2026-08-31 10:31:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/axohj74snk25g...
CVE-2026-82874
creationtimestamp| type| source ---|---|--- 2026-08-31 10:25:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7mzbbw6jjpkml...
CVE-2026-46470
creationtimestamp| type| source ---|---|--- 2026-08-31 09:40:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muemf3htjg2f...
CVE-2026-58301 Apache Shiro: Server-side POST request may be steered to an alternate host
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...