CVE-2026-3227-TP-Link-authenticated-RCE

CVE-2026-3227: TP-Link 라우터 OS 명령 삽입 자세한 정보는 https://vulners.com/cve/CVE-2026-3227 를 참조하세요. 영구적이며 인증된 OS 명령 삽입 취약점으로, TP-Link 라우터 펌웨어에서 기기를 벽돌로 만들거나 LAN 장악이 가능합니다. 면책 조항 : 이 저장소는 패치된 취약점에 대한 개념 증명PoC 코드를 포함하고 있습니다. 교육 목적 및 보안 연구자들을 위해 제공됩니다. 요약 여러 TP-Link 라우터TL-WR802N, TL-WR841N, TL-WR840N 포함의 구성...

CVE-2026-32645

Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts...

CVE-2026-33272

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...

CVE-2026-32645 Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials

Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts...

CVE-2026-32645

The Red Lion Controls N-Tron 700 Series is affected by a vulnerability involving the use of hard-coded credentials . Specifically, default factory credentials with administrative access remain active and persist even after additional administrator accounts have been configured. This flaw allows f...

EUVD-2026-95803

Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts...

CData API Server < 23.4.8844 - Path Traversal

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31848 info: name: CData API Server...

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

TOTOLINK A3002RU 1.0.8 - Information Disclosure

TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for password.htm. This allows remote attackers to gain administrative access without credentials. id: CVE-2018-13317 info: name:...

Tattile Camera < 1.181.5 - Default Login

Tattile Smart+, Vega, and Basic device families firmware = 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges. id: CVE-2026-26341 info: name: Tattile Camera 1.181.5 -...

CData Connect < 23.4.8846 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Connect 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31849 info: name: CData Connect 23.4.8846...

CVE-2025-8730

CVE-2025-8730 – Belkin F9K1009/F9K1010 인증 우회 작성자 : Byte Reaper 설명 : 이 저장소에는 Belkin F9K1009 및 F9K1010 라우터의 웹 인터페이스에 영향을 미치는 중요한 인증 우회 취약점인 CVE‑2025‑8730에 대한 익스플로잇이 포함되어 있습니다. 이 결함은 /login.htm 파일의 세션 검증 로직에 있으며, 부적절하게 처리된 쿠키나 조작된 요청을 통해 공격자가 유효한 자격 증명 없이 로그인 확인을 우회하고 관리자 인터페이스에 대한 전체 액세스 권한을 얻을 수...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...

CVE-2026-41940

CVE-2026-41940 — cPanel/WHM 認証バイパス 最近の脆弱性 CVE-2026-41940 は、cPanel/WHM を使用するサーバー管理者に大きな懸念をもたらしています。これは、有効な認証情報なしで管理パネルへの不正アクセスを可能にする、認証バイパスを許す可能性のある重大な欠陥です。 WHM が複数のサービスをホストするサーバーの主要な制御ポイントであることを考慮すると、この脆弱性は環境全体が完全に侵害される直接的なリスクを表します。 CVE-2026-41940 とは何か？ CVE-2026-41940 は、特定のバージョンの cPanel/WHM...

CVE-2026-14502

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication...

CVE-2026-14502 IBM DataPower Gateway Improper Authentication

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication...

CVE-2026-14502

The IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to an improper authentication flaw. The root cause is a failure to reject empty passwords during LDAP authentication , which could allow a...

EUVD-2026-94996

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication...

CVE-2026-89191

Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the...