Tenda W20E 安全漏洞

The Tenda W20E is a router from the Chinese company Tenda. The Tenda W20E suffers from a command injection vulnerability that stems from the formSetNetCheckTools function hostName parameter failing to correctly filter constructed command special characters, commands, and so on. No detailed...

CVE-2025-44867

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44867

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetNetCheckTools function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44867

The CVE describes a command-injection vulnerability in Tenda W20E V15.11.0.6, specifically in the formSetNetCheckTools function via the hostName parameter, allowing arbitrary command execution by crafted requests. Affected product: Tenda W20E. Root cause: failure to properly validate or filter sp...

CVE-2025-3995

A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /boafrm/fromStaticDHCP of the component LAN Settings Page. The manipulation of the argument Hostname leads to cross site...

CVE-2025-3989

A vulnerability classified as critical was found in TOTOLINK N150RT 3.4.0-B20190525. Affected by this vulnerability is an unknown functionality of the file /boafrm/formStaticDHCP. The manipulation of the argument Hostname leads to buffer overflow. The attack can be launched remotely. The exploit...

TOTOLINK N150RT 安全漏洞

The TOTOLINK N150RT is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK N150RT suffers from a buffer overflow vulnerability that originates from the parameter Hostname in the file /boafrm/formStaticDHCP that fails to correctly validate the length and size of the input data,...

CVE-2025-3785

A vulnerability has been found in D-Link DWR-M961 1.1.36 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formStaticDHCP of the component Authorization Interface. The manipulation of the argument Hostname leads to stack-based buffer overflow. The attack can ...

VulnCheck KEV: CVE-2024-7214

A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369B20220309 and classified as critical. Affected by this vulnerability is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. The attack can be launched...

Trimble SPS851 代码注入漏洞

The Trimble SPS851 is a modular GPS receiver from Trimble. A code injection vulnerability exists in the Trimble SPS851 version 488.01, which stems from the parameter Hostname of the component Ethernet Configuration Menu that leads to cross-site scripting...

The vulnerability of the SetWanSettings function in D-Link DIR-823G router software allows a hacker to execute arbitrary commands.

The vulnerability of the SetWanSettings function in D-Link DIR-823G router microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system’s processing of the HostName parameter. Exploiting this vulnerability allows a remote attacke...

TP-Link vn020-f3vt suffers from buffer overflow vulnerability

TP-LINK vn020-f3vt is a wireless modem from China P&L TP-LINK. A buffer overflow vulnerability exists in the TP-Link vn020-f3vt, which stems from the fact that incorrect manipulation of the parameter hostname can cause a stack-based buffer overflow. The vulnerability stems from a network system o...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the hostname parameter in capture.inc.php, when creating a new device. PoC Pass in a...

CVE-2024-49764

CVE-2024-49764 affects LibreNMS (librenms/librenms) with a Stored XSS in the Capture Debug Information page, exploitable via the hostname parameter when creating a new device. The underlying issue is improper sanitization of the output that can execute arbitrary JavaScript in authenticated users’...

TP-LINK VN020 安全漏洞

TP-LINK vn020-f3vt is a wireless modem from China P&L TP-LINK. A buffer overflow vulnerability exists in the TP-Link vn020-f3vt, which stems from the fact that incorrect manipulation of the parameter hostname can cause a stack-based buffer overflow. The vulnerability stems from a network system o...

CVE-2024-40579

Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive information via modification of the hostname parameter...

CVE-2024-40579

CVE-2024-40579 is a cross-site scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v1.7.1 . The issue is triggered via modification of the hostname parameter , enabling a remote attacker to obtain sensitive information. The CVSS v3.1 metrics indicate a base score 5.4 (MEDIUM)...

D-Link DIR-823G SetWanSettings Function Command Injection Vulnerability

The D-Link DIR-823G is a wireless router from China's AUO D-Link. The D-Link DIR-823G version 1.0.2B05 suffers from a command injection vulnerability that stems from the HostName parameter in the SetWanSettings function failing to properly filter constructed command special characters, commands,...

CVE-2024-51024

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51024

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...