@koa/router 安全漏洞

@koa/router is a routing middleware developed by Koa.js. Versions from 14.0.0 to 15.0.0 of @koa/router had a security vulnerability. This vulnerability occurred when the router prefix contained path parameters, causing the middleware to silently discard requests, which could lead to access contro...

PT-2026-43190

Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an...

CVE-2026-48694

FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniperplugin/fastnetmonjuniper.php, the $IPATTACK variable received from argv1 is directly interpolated into Juniper NETCONF set-configuration commands at...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32385)

TOTOLINK A8000RU is a wireless router produced by TOTOLINK, a company from China. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the setParentalRules function in the Web management interface’s /cgi-bin/cstecgi.cgi file, which...

CVE-2026-9495: Improper Access Control

Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an...

The vulnerability of the formsetPPPoE() function in the /goform/formsetPPPoE file of the Edimax BR-6675nD router’s microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the formsetPPPoE function in the /goform/formsetPPPoE file of the Edimax BR-6675nD router microprogramming software is related to the issue of the operation exceeding the buffer in memory when processing the pppUserName parameter. Exploiting this vulnerability allows an...

The vulnerability of the formWlanMP() function in the /goform/formWlanMP file of the Edimax BR-6675nD router’s microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability of the formWlanMP function in the /goform/formWlanMP file of the Edimax BR-6675nD router’s microprogramming system is related to the lack of data cleaning measures at the management level when processing parameters such as ateFunc, ateGain, ateRate, ateChan, ateTxCount,...

The vulnerability of the formUSBStorage() function in the /goform/formUSBStorage file of the Edimax BR-6675nD router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the formUSBStorage function in the /goform/formUSBStorage file of the Edimax BR-6675nD router’s microprogramming system is related to the lack of data cleaning at the control level when processing the subdir parameter. Exploiting this vulnerability allows an attacker to execu...

The vulnerability of the mp() function in the /goform/mp software for router devices from Edimax BR-6675nD allows a hacker to execute arbitrary commands.

The vulnerability of the mp function in the /goform/mp microprogramming system for Edimax BR-6675nD routers is related to the lack of data cleaning at the control level when processing the command parameter. Exploiting this vulnerability allows an attacker to execute arbitrary commands by sending...

CVE-2026-48695: Improper Neutralization of Special Elements used in an OS Command

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The log function in src/mikrotikplugin/fastnetmonmikrotik.php lines 107-108 constructs shell commands by concatenating the $msg parameter directly into exec calls:...

PT-2026-43354

Name of the Vulnerable Software and Affected Versions FastNetMon Community Edition versions prior to 1.3.0 Description A configuration injection issue exists in the Juniper router integration plugin. In the file src/juniper plugin/fastnetmon juniper.php, the variable IP ATTACK received from argv1...

The vulnerability of the formWanTcpipSetup() function in the /goform/formWanTcpipSetup file of the Edimax BR-6675nD router microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the formWanTcpipSetup function in the /goform/formWanTcpipSetup file of the Edimax BR-6675nD router microprogramming software is related to the issue of the operation exceeding the buffer boundaries in memory when processing the pppUserName parameter. Exploiting this...

The vulnerability of the formAccept() function in the /goform/formAccep file of the Edimax BR-6675nD router microprogramming software, which allows a hacker to execute arbitrary commands.

The vulnerability of the formAccept function in the /goform/formAccep file of the Edimax BR-6675nD router microprogramming software is related to the lack of data cleaning at the control level when processing the submit-url parameter. Exploiting this vulnerability allows an attacker to send...

The vulnerability of the formWlSiteSurvey() function in the /goform/formWlSiteSurvey file of the Edimax BR-6675nD router’s microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the formWlSiteSurvey function in the /goform/formWlSiteSurvey file of the Edimax BR-6675nD router’s microprogramming system is related to the issue where the operation’s output goes beyond the buffer in memory when processing the selSSID parameter. Exploiting this vulnerabili...

The vulnerability of the formWlbasic() function in the /goform/formWlbasic microprogramming system for Edimax BR-6428NS routers allows a hacker to execute arbitrary commands.

The vulnerability of the formWlbasic function in the /goform/formWlbasic microprogramming system for Edimax BR-6428NS routers is related to the lack of data cleaning measures at the control level when processing the repeaterSSID parameter. Exploiting this vulnerability allows an attacker to execu...

CVE-2026-48687

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The log function in src/juniperplugin/fastnetmonjuniper.php lines 117-118 constructs shell commands by concatenating the $msg parameter directly into exec calls:...

CVE-2026-48694

CVE-2026-48694 affects FastNetMon Community Edition up to 1.2.9 via the Juniper router integration plugin. The vulnerability arises because the variable $IP_ATTACK (from argv[1]) is directly interpolated into NETCONF set-configuration commands without validation, allowing an attacker-controlled I...

CVE-2026-48687: Improper Neutralization of Special Elements used in an OS Command

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The log function in src/juniperplugin/fastnetmonjuniper.php lines 117-118 constructs shell commands by concatenating the $msg parameter directly into exec calls:...

CVE-2026-48694: Improper Neutralization of Special Elements used in a Command

FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniperplugin/fastnetmonjuniper.php, the $IPATTACK variable received from argv1 is directly interpolated into Juniper NETCONF set-configuration commands at...

CVE-2026-48694

FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniperplugin/fastnetmonjuniper.php, the $IPATTACK variable received from argv1 is directly interpolated into Juniper NETCONF set-configuration commands at...