CVE-2025-0170

The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sortby' and 'token' parameters. This makes it possible for unauthenticated attackers to inject...

CVE-2025-0170 DWT - Directory & Listing WordPress Theme <= 3.3.3 - Reflected Cross-Site Scripting

The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping on the 'sortby' and 'token' parameters. This makes it possible for unauthenticated attackers to inject...

CVE-2024-57680

An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request...

CVE-2024-57683

An access control issue in the component websURLFilterAddDel of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the filter settings of the device via a crafted POST request...

CVE-2024-57683

CVE-2024-57683 affects D-Link DIR-816A2/DIR-816 devices via the websURLFilterAddDel component. The issue is an access control error that allows unauthenticated attackers to modify the device’s filtering rules by sending a crafted HTTP POST request. Several sources (NVD entry, Red Hat advisory, CN...

CVE-2024-57677

CVE-2024-57677 describes an access-control flaw in the D-Link 816A2 DIR-816 firmware (form2Wan.cgi) that allows unauthenticated attackers to configure the device’s WAN service via a crafted POST request. Root cause per documents: improper access control on the form2Wan.cgi endpoint, enabling mani...

CVE-2024-57681

CVE-2024-57681 affects the D-Link DIR-816A2 router, specifically the component form2alg.cgi in firmware DIR-816A2_FWv1.10CNB05_R1B011D88210. The vulnerability is an access control flaw that allows unauthenticated attackers to configure the device’s agl service via a crafted POST request. The CVSS...

CVE-2024-57680

An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request...

CVE-2024-57680

CVE-2024-57680 concerns a D-Link DIR-816A2 router vulnerability in the form2PortriggerRule.cgi component. The issue is an access control error that allows unauthenticated attackers to set the device port trigger via a crafted POST request to /form2PortriggerRule.cgi, affecting D-Link DIR-816A2_FW...

CVE-2024-57678

An access control issue in the component form2WlAc.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G mac access control list of the device via a crafted POST request...

D-Link DIR-816 安全漏洞

The D-Link DIR-816A2 is a router from China's AUO D-Link. The D-Link DIR-816A2 suffers from an Access Control Error vulnerability that stems from improper access control of the form2Wan.cgi component, which can be exploited by an unauthenticated attacker to set up WAN services via a specially...

CVE-2024-57679

An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G repeater service of the device via a crafted POST request...

CVE-2024-57676

An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G wlan service of the device via a crafted POST request...

CVE-2024-57679

An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G repeater service of the device via a crafted POST request...

CVE-2024-57683

An access control issue in the component websURLFilterAddDel of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the filter settings of the device via a crafted POST request...

CVE-2024-57684

CVE-2024-57684 describes an access-control flaw in the D-Link DIR-816A2 firmware, specifically in the component formDMZ.cgi. The issue allows unauthenticated users to configure the DMZ service via a crafted POST request, enabling potential exposure of internal services. The affected product is D-...

CVE-2024-57676

An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G wlan service of the device via a crafted POST request...

CVE-2024-57684

An access control issue in the component formDMZ.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the DMZ service of the device via a crafted POST request...

CVE-2024-57679

The CVE-2024-57679 issue affects D-Link DIR-816A2, firmware 1.10CNB05_R1B011D88210, due to an access-control flaw in form2RepeaterSetup.cgi. An unauthenticated attacker can craft a POST request to configure the 2.4G and 5G repeater services. The PT-2025-3537 report additionally notes the conditio...

CVE-2024-57684

An access control issue in the component formDMZ.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the DMZ service of the device via a crafted POST request...