PT-2026-93213

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd config show cgi.c, ipsec show cgi.c, and mod vpn remote/plan.json read handlers. Attackers can query l2tpd config show.cgi to expose stored IPsec PSK and RSA key material...

CVE-2026-52484

The MitraStar GPT-2742GX4X5v6-SV router, running firmware GL_g2.5_100XNT0b23_3 , contains a command injection vulnerability in the /cgi-bin/device-management-utilities-internet.cgi component. An authenticated attacker can execute arbitrary code by bypassing special character filters using URL-enc...

PT-2026-93190

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan config set cgi, wan num set cgi, and lan ip change cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network...

PT-2026-93205

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod vpn remote/plan.json, pptpd user show.cgi, pptp client config show.cgi, and l2tpd user show.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials...

PT-2026-93201

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing tab add cgi, routing table list show cgi, route policy add cgi, and route policy parame show cgi. Attackers can inject persistent scri...

PT-2026-93199

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in the QoS setter CGI handlers filter conn del cgi.c and gre prio set cgi.c due to unchecked atoi results. An attacker can trigger the flaw by supplying crafted input to these handlers, causing a denial of servic...

PT-2026-93206

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in DHCP static IP and IP ACL management pages, including dhcp add staticip cgi, dhcp staticip show cgi, ip acl set cgi, and ip acl show cgi. Attackers can inject persistent malicious scripts through these...

CVE-2026-52484

An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...

PT-2026-91860

A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the...

PT-2026-92170

An issue in MitraStar GPT-2742GX4X5v6-SV GL g2.5 100XNT0b23 3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...

EUVD-2026-78943

An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...

CVE-2026-52484: Improper Neutralization of Special Elements used in an OS Command

An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...

CVE-2026-91003: Stack-based Buffer Overflow

A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzglasp of the file /rzgl.asp of the component CGI Service. This manipulation of the argument redircturl causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been...

PT-2026-93191

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns wan list show.cgi endpoint and related DDNSset cgi, IGD GetCgiHandler, and IGD CgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...

PT-2026-93117

The affected products are missing authorization on state-changing CGIs and session checks are not performed...

PT-2026-93198

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval in qos xianz add cgi, qos xianz show cgi, qos filter add cgi, and qos filter show cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stor...

CVE-2026-90881: Exposure of Sensitive Information to an Unauthorized Actor

A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the...

Astra Linux – Vulnerability in Ruby 2.5

In Ruby, the CGI::Cookie.parse method used from version 2.6.8 mishandles security prefixes in cookie names. This issue also affects the CGI gem used from version 0.3.0 in Ruby...

Astra Linux – Vulnerability in mapserver

Versions of MapServer prior to 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 do not properly enforce the MSMAPNOPATH and MSMAPPATTERN restrictions, which are intended to control the locations from which a mapfile can be loaded via MapServer CG...

Astra Linux – Vulnerability in Jetty9

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to an org.eclipse.jetty.servlets.CGI Servlet for a binary file whose name contains...