CVE-2026-51628

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51631

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51626

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51631: Improper Access Control

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51628: Improper Access Control

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51628

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51631

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51628

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51626

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51628

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control issue in the getGenerateWiFiWpsPin function. An unauthenticated attacker can generate and retrieve a new WPS PIN by sending a crafted POST request to /cgi-bin/cstecgi.cgi. While t...

CVE-2026-51626

The TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getWiFiWpsCfg function. This vulnerability allows unauthenticated attackers to obtain WPS configuration details, including the current PIN , by sending a crafted POST req...

EUVD-2026-67893

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67896

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-67898

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83196

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83191

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51631

Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51626

Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain WPS configuration, including the current PIN, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83193

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

WordPress WPS Bidouille plugin < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users vulnerability

Subscriber+ User Email Disclosure via wpsgetusers vulnerability discovered by Shikhali Jamalzade in WordPress Plugin WPS Bidouille versions 1.33.5...