sub_424054() and sub_41EA94() functions Code Execution

The vulnerability of the sub424054 and sub41EA94 functions in the embedded web server of D-Link’s router microprogramming systems DIR-822K and DWR-M920 is related to the escape of operations from the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a...

Tenda AC21 Router DoS

The vulnerability of the httpd-demon /goform/saveParentControlInfo of the Tenda AC21 router’s microprogramming system is related to the execution of operations outside the buffer in memory when processing the urls parameter. Exploiting this vulnerability allows a malicious actor to cause service...

Tenda AC21 Router httpd-demon SetIpMacBind Command Execution DoS

The vulnerability of the httpd-demon /goform/SetIpMacBind of the Tenda AC21 router’s microprogramming software is related to the operation that goes beyond the buffer in memory when processing the list parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

sub_414BA8() and sub_4138B0() functions Code Execution

The vulnerability of the sub414BA8 and sub4138B0 functions in the embedded web server of D-Link’s DIR-822K and DWR-M920 router microprogramming systems is related to the issue of the operation exceeding the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability...

USN-7892-1: H2O vulnerability

It was discovered that H2O exhibited poor server resource management in its HTTP/2 protocol. An attacker could possibly use this issue to cause H2O to crash, resulting in a denial of service...

EUVD-2025-199678

Unauthenticated Arbitrary File Deletion upgradecontents.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgrade parameter allows unauthenticated deletion of arbitrary...

CVE-2025-66261

Unauthenticated OS Command Injection restoresettings.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter passed to exec allows remote code execution. The...

CVE-2025-66263

Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in downloadsetting.php allows reading arbitrary files...

CVE-2025-66263

The CVE-2025-66263 entry describes an unauthenticated arbitrary file read due to a null byte injection in the Mozart FM Transmitter’s download_setting.php. The PHP code appends a forced .tgz extension to user-supplied $_GET['filename'], and on PHP 5.3.2 (pre-5.3.4) the null byte (%00) terminates ...

CVE-2025-66261 Unauthenticated OS Command Injection (restore_settings.php)

Unauthenticated OS Command Injection restoresettings.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter passed to exec allows remote code execution. The...

CVE-2025-66253 Unauthenticated OS Command Injection (start_upgrade.php)

Unauthenticated OS Command Injection startupgrade.php in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec allows remote code execution via...

PT-2025-48324

CVE-2025-66228 - Apache HTTP Server Unvalidated User Input CVE ID : CVE-2025-66228 Published : Nov. 26, 2025, 4:15 a.m. | 2 hours, 49 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

PT-2025-48117

Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in download setting.php allows reading arbitrary files...

PT-2025-48325

CVE-2025-66229 - Apache HTTP Server Remote Code Execution Vulnerability CVE ID : CVE-2025-66229 Published : Nov. 26, 2025, 4:15 a.m. | 2 hours, 49 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products,...

PT-2025-48327

CVE-2025-66231 - Apache HTTP Server Cross-Site Request Forgery CVE ID : CVE-2025-66231 Published : Nov. 26, 2025, 4:15 a.m. | 2 hours, 49 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and...

PT-2025-48105

Name of the Vulnerable Software and Affected Versions DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 Description An unauthenticated OS Command Injection issue exists in the start upgrade.php component of the softwar...

HTTP Easy File Sharing Buffer Overflow

The vulnerability of the HTTP Easy File Sharing server relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2025-47938

CVE-2025-12759 - CVE-2022-1234: Apache HTTP Server Unvalidated User Input CVE ID : CVE-2025-12759 Published : Nov. 23, 2025, 11:15 p.m. | 3 hours, 32 minutes ago Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the...

D-Link Router Code Execution

The vulnerability of the embedded web server microprogramming software in D-Link routers such as DWR-M920, DWR-M921, DIR-822K, and DIR-825M is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

D-Link Router Web Server Code Execution

The vulnerability of the built-in web server of the D-Link routers DWR-M920, DWR-M921, DWR-M960, DIR-822K, and DIR-825M lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure...