CVE-2024-57595

DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apcclientpin.cgi, which allows remote attackers to execute arbitrary commands via the parameter "wpspin" passed to the apcclientpin.cgi binary through a POST request...

CVE-2024-57590

TRENDnet TEW-632BRP v1.010B31 is affected by an OS command injection in the CGl interface ntp_sync.cgi. The vulnerability allows a remote attacker to execute arbitrary commands by sending a crafted ntp_server parameter in a POST request to ntp_sync.cgi. CVSS v3.1 base score 9.8 (CRITICAL) with Ne...

D-Link DIR-816A2 websURLFilterAddDel Component Access Control Error Vulnerability

The D-Link DIR-816A2 is a router from China's AUO D-Link. The D-Link DIR-816A2 suffers from an Access Control Error vulnerability that stems from improper access control of the websURLFilterAddDel component, which can be exploited by an unauthenticated attacker to set up filtering rules via a...

The vulnerability of the formSetDeviceName and sub_C6BB0 functions in the Tenda AC18 router’s microprogramming system allows a hacker to induce a service failure.

The vulnerability of the formSetDeviceName and subC6BB0 functions in the Tenda AC18 router’s microprogramming system lies in the possibility of copying input data into the buffer without checking its size. Exploiting this vulnerability could allow a malicious actor to cause a service failure by...

The vulnerability in the /goform/form2NetSniper.cgi microprogramming of the D-Link DIR-816 A2 wireless router allows a intruder to gain unauthorized access to protected information.

The vulnerability of the /goform/form2NetSniper.cgi microprogramming software for D-Link DIR-816 A2 wireless routers is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information by sendin...

D-Link DIR-878 Information Disclosure Vulnerability

The D-Link DIR-878 is a wireless router from China's AUO D-Link. An information disclosure vulnerability exists in the D-Link DIR-878 version 1.03, which stems from insufficient protection of sensitive information in the component HTTP POST request handler, and can be exploited by an attacker to...

CVE-2024-57681

An access control issue in the component form2alg.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request...

CVE-2024-57680

An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request...

CVE-2024-57677

An access control issue in the component form2Wan.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the wan service of the device via a crafted POST request...

CVE-2024-57682

An information disclosure vulnerability in the component dstatus.asp of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to access sensitive information via a crafted POST request...

CVE-2024-57683

An access control issue in the component websURLFilterAddDel of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the filter settings of the device via a crafted POST request...

Indico Insecure Access

A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals...

GHSA-3WG7-R7Q5-R2JF Indico Insecure Access

A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals...

CVE-2025-0473

Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimportauthorities’ endpoint. When a file is uploaded via this...

CVE-2025-0473 Incomplete Cleanup vulnerability in PMB platform

Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimportauthorities’ endpoint. When a file is uploaded via this...

CVE-2024-57677

An access control issue in the component form2Wan.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the wan service of the device via a crafted POST request...

CVE-2024-57682

CVE-2024-57682 affects D-Link DIR-816A2 devices (firmware 1.10CNB05_R1B011D88210) in the component d_status.asp . The vulnerability is an information disclosure that allows unauthenticated attackers to access sensitive information via a crafted POST request. The available documents consistently d...

CVE-2024-57680

An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request...

CVE-2024-57681

CVE-2024-57681 affects the D-Link DIR-816A2 router, specifically the component form2alg.cgi in firmware DIR-816A2_FWv1.10CNB05_R1B011D88210. The vulnerability is an access control flaw that allows unauthenticated attackers to configure the device’s agl service via a crafted POST request. The CVSS...

CVE-2024-57679

An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G repeater service of the device via a crafted POST request...