The vulnerability of the fromSafeMacFilter() function (/goform/SafeMacFilter) in the Tenda F456 router software allows a hacker to execute arbitrary code or cause service failures.

The vulnerability of the fromSafeMacFilter function /goform/SafeMacFilter of the Tenda F456 router microprogramming system is related to the copying of buffers without checking the size of the input data when processing the page parameter. Exploiting this vulnerability can allow an attacker to...

The vulnerability of the fromP2pListFilter() function (/goform/P2pListFilter) in the Tenda F456 router software allows a hacker to execute arbitrary code or cause service failures.

The vulnerability of the fromP2pListFilter function /goform/P2pListFilter of the Tenda F456 router’s software lies in the copying of buffers without checking the size of the input data when processing parameters for manufacturer and Go. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the fromSafeClientFilter() function (/goform/SafeClientFilter) in the Tenda F456 router software allows a attacker to execute arbitrary code or cause service failures.

The vulnerability of the fromSafeClientFilter function /goform/SafeClientFilter in the Tenda F456 router microprogramming system is related to the copying of buffers without checking the size of the input data when processing parameters menufacturer and Go. Exploiting this vulnerability allows a...

CVE-2026-41903: Incorrect Authorization

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user holding the PERMEDITUSERS permission intended for general user-profile editing can read and modify the notification subscriptions of any other user, including admins, by sending a...

The vulnerability of the fromSetIpBind() function (/goform/SetIpBind) in the httpd microprogramming software for Tenda F456 routers allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the fromSetIpBind function /goform/SetIpBind in the HTTPD microprogramming software for Tenda F456 routers is related to the copying of buffers without checking the size of the input data when processing the page parameter. Exploiting this vulnerability could allow an attacke...

Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

We identified a vulnerability in the latest version of Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. Yii’s dynamic object configuration, as implemented in...

CVE-2026-7841

GV-ASWeb 6.2.0 contains a remote code execution via the ASWebCommon.srf backend when an authenticated user with System Setting permissions sends a crafted HTTP POST to bypass frontend restrictions. CVSSv3.1: 8.8 (HIGH), AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Exploitation status is not provided in t...

CVE-2026-7841

A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint to bypass the fronte...

CVE-2026-7841 GV-ASWeb Remote Code Execution (RCE) vulnerability

A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint to bypass the fronte...

The vulnerability of the loginauth() function in the cgi-bin/cstecgi.cgi script of the TOTOLINK N300RH router’s microprogramming system allows a intruder to execute arbitrary code or cause a service failure.

The vulnerability of the loginauth function in the cgi-bin/cstecgi.cgi script of the TOTOLINK N300RH router’s microprogramming system is related to the issue of the operation going beyond the buffer in memory when processing the password parameter stored in variable v10. Exploiting this...

PT-2026-37354

A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint to bypass the fronte...

The vulnerability of the Nginx UI server’s user interface allows a perpetrator to gain unauthorized access to the system.

The vulnerability of the Nginx UI server’s user interface lies in the lack of authentication for critical functions. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to the system by sending a specially crafted POST request...

CVE-2026-7719

A security flaw has been discovered in Totolink WA300 5.2cu.7112B20190227. The affected element is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument httphost results in buffer overflow. The attack may be launched...

CVE-2026-32699

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction b...

EUVD-2026-27438

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction b...

CVE-2026-32699

FacturaScripts (versions ≤ 2025.92) exposes a vulnerability in the EditUser endpoint where the nick field is not validated on POST, allowing an attacker to modify an immutable nickname by intercepting and altering form-data. The UI prevents editing this field, but a modified request can rename an...

CVE-2026-32699 FacturaScripts unauthorized modification of immutable nick field via EditUser controller

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction b...

CVE-2026-32699

FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction b...

CVE-2026-7718

A vulnerability was identified in Totolink WA300 5.2cu.7112B20190227. Impacted is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument webWlanIdx leads to command injection. The attack may be initiated remotely. The...

The vulnerability of the setMacFilterRules() function in the cgi-bin/cstecgi.cgi script of the TOTOLINK N300RH router’s microprogramming software allows a intruder to execute arbitrary code or cause a service failure.

The vulnerability of the setMacFilterRules function in the cgi-bin/cstecgi.cgi script of the TOTOLINK N300RH router’s microprogramming system is related to the issue of the operation going beyond the buffer in memory when processing the macaddress parameter stored in variable v11. Exploiting this...