25 matches found
PT-2026-95785
Name of the Vulnerable Software and Affected Versions VW Writer Blog theme for WordPress versions prior to 1.3.9 Description The software allows unauthorized modification of data because the vw writer blog reset all settings function lacks a proper capability check. Authenticated users with...
CVE-2026-48530
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The...
CVE-2026-1924
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing nonce verification on the ahscajaxresetoptions function. This makes it possible for unauthenticated attackers to reset all plugin settings t...
CVE-2026-8681 Essential Chat Support <= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter
The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset all...
CVE-2026-4133
The TextP2P Texting Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.7. This is due to missing nonce validation in the imTextP2POptionPage function which processes settings updates. The form at line 314 does not include a wpnoncefield,...
Wavlink M86X3A Router Sub_400B90 Function DoS
The vulnerability of the sub400B90 function in the /cgi-bin/ExportAllSettings.cgi script of the Wavlink M86X3A router’s microprogramming system is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause a servic...
EUVD-2025-31379
Malicious code in bioql PyPI...
CVE-2025-55847
Wavlink M86X3AV240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service D...
CVE-2025-55847
Wavlink M86X3AV240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service D...
CVE-2025-55847
Wavlink M86X3AV240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service D...
CVE-2025-55847
Wavlink M86X3AV240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitrary code or cause a denial of service D...
PT-2025-39670
Name of the Vulnerable Software and Affected Versions Wavlink M86X3A V240730 affected versions not specified Description The software contains a buffer overflow issue in the /cgi-bin/ExportAllSettings.cgi file. The problem is due to insufficient validation of the length of input data received...
Wavlink M86X3A_V240730 security vulnerability
Wavlink M86X3AV240730 is a device firmware from China Ruiyin Wavlink. A security vulnerability exists in Wavlink M86X3AV240730, which originates from a cookie parameter in the /cgi-bin/ExportAllSettings.cgi file that does not correctly validate the length of the input data, which could result in...
CVE-2025-55847
The Wavlink M86X3A_V240730 router contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The root cause is the sub_400B90() function's failure to properly validate the length of input data received via the Cookie parameter. Successful exploitation could allow an atta...
PT-2025-9585
Name of the Vulnerable Software and Affected Versions VW Storefront theme for WordPress versions up to, and including, 0.9.9 Description The issue allows authenticated attackers with Subscriber-level access and above to modify data due to a missing capability check on the vw storefront reset all...
PT-2024-24449
Name of the Vulnerable Software and Affected Versions WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress versions up to, and including, 4.4.2 Description The issue allows unauthorized modification of data due to a missing capability check on the wt...
PT-2023-11370
Name of the Vulnerable Software and Affected Versions GDPR Cookie Compliance plugin for WordPress versions up to, and including, 4.0.2 Description The issue is related to a missing capability check on the gdpr cookie compliance reset settings AJAX action, which allows authenticated attackers to...
CVE-2022-34045
Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etcro/lighttpd/www/cgi-bin/ExportAllSettings.sh...
PT-2022-21982
Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 version M30HG4.V5030.191116 Description A hardcoded encryption/decryption key was found in the configuration files of the affected device, specifically at the /etc ro/lighttpd/www/cgi-bin/ExportAllSettings.sh location. This...