TRENDnet TEW-821DAP: Data Forgery Vulnerability

TRENDnet TEW-821DAP is a wireless access point from the company TRENDnet. The version TRENDnet TEW-821DAP 1.12B01 has a vulnerability related to data falsification. This vulnerability stems from improper handling of the parameter dest in the findHWid/newGuiUpdateFirmware function within the...

Open Redirect

Overview @saltcorn/server is a Server app for Saltcorn, open-source no-code platform Affected versions of this package are vulnerable to Open Redirect via the isrelativeurl function. An attacker can redirect users to an external, attacker-controlled domain by crafting a malicious URL that exploit...

PT-2026-35307

Summary Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes to forward slashes / for special schemes, a payload such as /evil.com/path slips through is relative url, is emitted unchanged in th...

TRENDnet TEW-713RE Command Injection Vulnerability

The TRENDnet TEW-713RE is a wireless network range extender from TRENDnet. The TRENDnet TEW-713RE suffers from a command injection vulnerability that originates from a misuse of the parameter dest in the file /goform/addRouting, which can be exploited by an attacker to cause arbitrary command...

CVE-2026-5183

A vulnerability was determined in TRENDnet TEW-713RE up to 1.02. The affected element is the function sub421494 of the file /goform/addRouting. Executing a manipulation of the argument dest can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly...

CVE-2026-5183

CVE-2026-5183 affects TRENDNet TEW-713RE (up to firmware 1.02). The vulnerable element is the function sub_421494 in the file /goform/addRouting; manipulating the argument dest can cause a remote command injection. Public exploit information exists; vendor has not responded to disclosure. Connect...

PT-2026-29200

A vulnerability was determined in TRENDnet TEW-713RE up to 1.02. The affected element is the function sub 421494 of the file /goform/addRouting. Executing a manipulation of the argument dest can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly...

TRENDnet TEW-713RE command injection vulnerability

The TRENDnet TEW-713RE is a wireless network range extender from TRENDnet. The TRENDnet TEW-713RE suffers from a command injection vulnerability that originates from a misuse of the parameter dest in the file /goform/addRouting, which can be exploited by an attacker to cause arbitrary command...

CVE-2026-25539

SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution RCE by writing to sensitive...

CVE-2026-25539: Improper Limitation of a Pathname to a Restricted Directory

SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution RCE by writing to sensitive...

EUVD-2008-0926

Malware in sbrugna...

EUVD-2007-2041

Malware in sbrugna...

TOTOLINK T6 dest parameter buffer overflow vulnerability

TOTOLINK T6 is a wireless dual-band router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK T6 version 4.1.5cu.748B20211015, which originates from the parameter dest of the recvSlaveStaInfo function of the MQTT service failing to correctly validate the...

TOTOLink T6 MQTT Code Execution

The vulnerability of the recvSlaveStaInfo function in the MQTT service of the TOTOLink T6 mesh-system’s microprogramming system is related to the issue of the operation going beyond the buffer in memory when processing the dest parameter. Exploiting this vulnerability allows a remote attacker to...

Tenda O3 Wireless Access Point Arbitrary Command Execution

The vulnerability of the fromTraceroutGet function /goform/getTraceroute in the Tenda O3 wireless access point software exists because measures are not taken to neutralize special elements when processing the dest parameter. Exploiting this vulnerability allows a remote attacker to execute...

Tenda O3V2 /goform/getTraceroute file command injection vulnerability

Tenda O3V2 is an outdoor wireless bridge from Tenda, China. The Tenda O3V2 suffers from a command injection vulnerability that stems from the parameter dest in the file /goform/getTraceroute failing to correctly filter constructed command special characters, commands, and so on. No details of the...

CVE-2025-3882

eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of eCharge Hardy Barth cPH2 charging stations. Authentication is not required to exploit th...

CVE-2025-3882: Improper Neutralization of Special Elements used in an OS Command

eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of eCharge Hardy Barth cPH2 charging stations. Authentication is not required to exploit th...

eCharge Hardy Barth cPH2: Operating system command injection vulnerability

The eCharge Hardy Barth cPH2 is an electric vehicle charging station from eCharge. The eCharge Hardy Barth cPH2 suffers from an operating system command injection vulnerability that stems from the dest parameter not being properly validated in the nwcheckexec.php endpoint, which could lead to...

GFI Kerio Control security vulnerabilities

GFI Kerio Control is a Unified Threat Management UTM solution from GFI Malta. The product includes features such as virus protection, web content filtering and application filtering. A security vulnerability exists in GFI Kerio Control that stems from the Dest parameter on some pages not being...