CVE-2023-31471

An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install...

CVE-2023-31476

An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters the working directory is /www...

CVE-2023-24261

A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request...

CVE-2020-15500

An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS...

The vulnerability of the administrator panel of microprogrammed software routers such as GL-A1300, GL-AX1800, GL-AXT1800, GL-MT3000, GL-MT2500, GL-MT6000, GL-MT1300, GL-MT300N-V2, GL-AR750S, GL-AR750, GL-AR300M, and GL-B1300 allows attackers to circumvent security restrictions, gain increased privileges, and obtain full control over the device.

The vulnerability of the administrator panel of microprogrammed software routers such as GL-A1300, GL-AX1800, GL-AXT1800, GL-MT3000, GL-MT2500, GL-MT6000, GL-MT1300, GL-MT300N-V2, GL-AR750S, GL-AR750, GL-AR300M, and GL-B1300 is related to deficiencies in authentication procedures. Exploiting this...

Multiple vulnerabilities in GL-MT2500 and GL-MT2500A

Overview GL-MT2500 and GL-MT2500A provided by GL.iNet contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2024-57391 Inefficient regular expression complexity CWE-1333 - CVE-2025-2811 Chuya Hayakawa and Ryo Kamino of 00One, Inc. reported these vulnerabilities to...

PT-2025-20604 · Undefined · Undefined

⚠️ Vulnerability Alert: Multiple vulnerabilities in GL-MT2500 and GL-MT2500A 📅 Timeline: Not provided 🆔 cveId: CVE-2024-57391 📊 baseScore: 7.2 📏 cvssMetrics: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H cvssSeverity: High 🟠 📈 EPSS Percentile: Not available 🛠️...

GHSA-75V8-2H7P-7M2M vulnerabilities

Vulnerabilities for packages: tileserver-gl...

CVE-2025-46653 vulnerabilities

Vulnerabilities for packages: tileserver-gl...

CVE-2025-46653 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, tileserver-gl...

GHSA-75V8-2H7P-7M2M vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, tileserver-gl...

GL.iNet Router 安全漏洞

GL.iNet Router is a series of routers from China's Guanglian Zhitong GL.iNet company. A security vulnerability exists in GL.iNet Router that originates from a buffer overflow in the plugins.so file of the RPC Handler component...

CVE-2024-12905 vulnerabilities

Vulnerabilities for packages: sqlpad, tileserver-gl, code-server...

GHSA-PQ67-2WWV-3XJX vulnerabilities

Vulnerabilities for packages: sqlpad, tileserver-gl, code-server...

CVE-2024-12905 vulnerabilities

Vulnerabilities for packages: kibana, tileserver-gl, sqlpad, code-server, tileserver-gl-fips...

GHSA-PQ67-2WWV-3XJX vulnerabilities

Vulnerabilities for packages: kibana, tileserver-gl, sqlpad, code-server, tileserver-gl-fips...

The vulnerability of the File Sharing function on the administrator web panel of microprogramming router software GL.iNet GL-MT3000 allows a hacker to read arbitrary files.

The vulnerability of the File Sharing function on the administrator web panel of the GL.iNet GL-MT3000 router software relates to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow an attacker, operating remotely, to read arbitrary files...

CVE-2025-25685

An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. Attackers are able to download arbitrary files from the device's file system via adding symbolic links on an external drive used as a samba share...

CVE-2025-25684

A lack of validation in the path parameter /download of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request...

CVE-2025-25685

An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. Attackers are able to download arbitrary files from the device's file system via adding symbolic links on an external drive used as a samba share...