CVE-2025-4730

A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads to buffer...

CVE-2025-4731 TOTOLINK A3002R/A3002RU HTTP POST Request formPortFw buffer overflow

A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument servicetype/ipsubnet leads to buffer overflow. It is...

CVE-2025-4731 TOTOLINK A3002R/A3002RU HTTP POST Request formPortFw buffer overflow

A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument servicetype/ipsubnet leads to buffer overflow. It is...

CVE-2025-4731

Summary: CVE-2025-4731 affects TOTOLINK A3002R and A3002RU running 3.0.0-B20230809.1615. The vulnerability lies in the HTTP POST Request Handler, specifically the /boafrm/formPortFw file, where manipulating the argument commonly labeled as either service_type or ip_subnet leads to a buffer overfl...

CVE-2025-4730

TOTOLINK A3002R/A3002RU (version 3.0.0-B20230809.1615) is affected by a buffer overflow in the HTTP POST Request Handler, specifically in the /boafrm/formMapDel function when the devicemac1 argument is manipulated. The vulnerability can be exploited remotely and is described as critical in multip...

CVE-2025-4730 TOTOLINK A3002R/A3002RU HTTP POST Request formMapDel buffer overflow

A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads to buffer...

CVE-2025-4730 TOTOLINK A3002R/A3002RU HTTP POST Request formMapDel buffer overflow

A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads to buffer...

The vulnerability of the built-in boa server (/boafrm/formWsc) of TOTOLINK N150RT router microprogramming software allows a intruder to cause a service failure.

The vulnerability of the built-in boa server /boafrm/formWsc of TOTOLINK N150RT router microprogramming software is related to the copying of buffers without checking the size of input data when processing the localPin parameter. Exploiting this vulnerability allows an attacker to cause service...

CVE-2025-4729 TOTOLINK A3002R/A3002RU HTTP POST Request formMapDelDevice command injection

A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr lead...

CVE-2025-4729

Totolink A3002R/A3002RU (v3.0.0-B20230809.1615) are affected by a command-injection vulnerability in the HTTP POST handler for the /boafrm/formMapDelDevice endpoint. Exploitation centers on tampering with the macstr parameter, with remote access and disclosure of the exploit noted. The PT-2025-21...

CVE-2025-46053

A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.php...

PT-2025-21285 · Weberp · Weberp

Name of the Vulnerable Software and Affected Versions: WebERP version 4.15.2 Description: An error-based SQL Injection SQLi vulnerability allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to...

CVE-2025-46053

A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.php...

CVE-2025-46052

CVE-2025-46052 involves WebERP v4.15.2 with an error-based SQL Injection affecting the DEL form field in a POST request to /StockCounts.php. The underlying issue allows an attacker to execute arbitrary SQL and extract sensitive data. Multiple connected sources confirm the vulnerable endpoint and ...

CVE-2025-46053

A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.php...

PT-2025-21588 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R and A3002RU version 3.0.0-B20230809.1615 Description: A critical vulnerability has been found in the HTTP POST Request Handler component of TOTOLINK A3002R and A3002RU. This affects an unknown part of the file...

PT-2025-21589 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R and A3002RU version 3.0.0-B20230809.1615 Description: A critical issue was found in the HTTP POST Request Handler component, specifically affecting unknown code of the file /boafrm/formFilter. The manipulation of the ip6addr...

PT-2025-21586 · Totolink · Totolink A3002Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R and A3002RU version 3.0.0-B20230809.1615 Description: A critical issue affects an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr...

The vulnerability of the pureauthcheck function in the HTTP POST Request Handler of the microprogramming-based wireless access point D-Link DAP-1562 allows a intruder to cause a service failure.

The vulnerability of the HTTP POST Request Handler component of the pureauthcheck function in the wireless access point software of D-Link DAP-1562 is related to the manipulation of the null pointer. Exploiting this vulnerability could allow a malicious actor to cause service failure...

Cross-site Scripting (XSS)

Overview org.webjars.npm:bootstrap-multiselect is a JQuery multiselect plugin based on Twitter Bootstrap. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the post.php script. An attacker can execute scripts in the context of the user's browser session by sendi...