XSS-CVE-2022-30489

WAVLINK WN535G3 POST XSS 使用 CVE-2022-30489 Payload POST /cgi-bin/login.cgi HTTP/1.1 Host: 98.127.66.193 Content-Length: 255 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://98.127.66.193 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 Windows NT 10.0;...

cve-2026-41940-cpanel_authbypass_reproduction

CVE-2026-41940 — cPanel & WHM 身份验证绕过 CVSS v3.1：9.8（严重） 概述 CVE-2026-41940 是 cPanel & WHM 中的一个严重身份验证绕过漏洞，允许未经身份验证的攻击者获得控制面板的完全管理权限。该漏洞在公开披露后的 24 小时内即被野外利用，勒索软件被部署在易受攻击的主机上。该漏洞由 watchTowr 研究人员发现并公开披露。 技术细节 cPanel/WHM 的登录流程在身份验证握手期间未正确验证会话令牌。通过向登录端点发送特定序列的 HTTP 请求，攻击者可以操纵服务器接受伪造或跳过的身份验证步骤，从而有效绕过凭证验证。...

CVE-2026-76070

CVE-2026-76070: Unauthenticated Pre-Auth Stack Buffer Overflow via Base64-Decoded Password in Netis NC63 login.cgi Leading to RCE Researcher: Özcan Ersan @ozcanpng Disclosure status CVE: CVE-2026-76070 Vendor: Netis Systems Co., Ltd. Product: Netis NC63 Wireless AC1200 Router Tested firmware:...

Exploit for CVE-2026-76070

CVE-2026-76070: Unauthenticated Pre-Auth Stack Buffer Overflow...

Cisco Secure Firewall Management Center login.cgi Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Cisco Secure Firewall Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the login.cgi endpoint. The issue results from improper...

CVE-2025-71317: Use of Hard-coded Credentials

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax...

CVE-2026-8230

A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function syslogin1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Th...

CVE-2026-8230 Wavlink NU516U1 login.cgi sys_login1 os command injection

A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function syslogin1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Th...

CVE-2026-8230 Wavlink NU516U1 login.cgi sys_login1 os command injection

A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function syslogin1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Th...

CVE-2026-8230

CVE-2026-8230 affects Wavlink NU516U1 240425. The vulnerability lies in the /cgi-bin/login.cgi file, within the function called sys_login1, where manipulating the ipaddr argument can trigger an OS command injection. This allows remote attackers to execute commands on the device. Exploitation is p...

PT-2026-39456

Name of the Vulnerable Software and Affected Versions Wavlink NU516U1 version 240425 Description A flaw in the sys login1 function within the '/cgi-bin/login.cgi' endpoint allows for remote OS command injection. This occurs through the manipulation of the ipaddr argument, which could lead to full...

Wavlink NU516U1 命令注入漏洞

Wavlink NU516U1 is a wireless printing server developed by Wavlink Corporation. The Wavlink NU516U1 240425 version has a command injection vulnerability. This vulnerability stems from the operation of the syslogin1 function in the /cgi-bin/login.cgi file, where the parameter ipaddr is processed...

CVE-2026-8230: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function syslogin1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Th...

CVE-2026-6559

A weakness has been identified in Wavlink WL-WN579A3 220323. This affects the function sub401F80 of the file /cgi-bin/login.cgi. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. Upgrading the affected component is recommended...

CVE-2026-6559

A weakness has been identified in Wavlink WL-WN579A3 220323. This affects the function sub401F80 of the file /cgi-bin/login.cgi. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. Upgrading the affected component is recommended...

CVE-2026-4544

A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Handler. Executing a manipulation of the argument homepage/hostname/loginpage can lead to cross site scripting. It is possible to launch the...

PT-2026-26975

A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects an unknown function of the file /cgi-bin/login.cgi of the component POST Request Handler. Executing a manipulation of the argument homepage/hostname/login page can lead to cross site scripting. It is possible to launch the...

EUVD-2026-12208

A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub404F68 of the file /cgi-bin/login.cgi. The manipulation of the argument homepage/hostname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and coul...

CVE-2026-4166: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub404F68 of the file /cgi-bin/login.cgi. The manipulation of the argument homepage/hostname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and coul...

CVE-2026-3703

A flaw has been found in Wavlink NU516U1 251208. This affects the function sub401A10 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to out-of-bounds write. The attack may be performed from remote. The exploit has been published and may be used. Upgrading...