CVE-2025-0848 Tenda A18 HTTP POST Request SetCmdlineRun stack-based overflow

A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapskcrypto5g leads to stack-based buffer overflow...

CVE-2025-0848

The CVE-2025-0848 entry concerns the Tenda A18 router (versions up to 15.13.07.09) with a vulnerability in the HTTP POST handler function SetCmdlineRun. The root cause is a stack-based buffer overflow triggered by manipulating the wpapsk_crypto5g argument, which can be exploited remotely. Public ...

CVE-2025-0848 Tenda A18 HTTP POST Request SetCmdlineRun stack-based overflow

A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapskcrypto5g leads to stack-based buffer overflow...

CVE-2025-0848: Stack-based Buffer Overflow

A vulnerability was found in Tenda A18 up to 15.13.07.09. It has been rated as critical. This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapskcrypto5g leads to stack-based buffer overflow...

CVE-2025-20061: Improper Neutralization of Special Elements used in an OS Command

mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system...

mySCADA myPRO operating system command injection vulnerability

mySCADA myPRO is a professional HMI/SCADA system from mySCADA, Inc. designed for the visualization and control of industrial processes. An operating system command injection vulnerability exists in mySCADA myPRO that stems from an inability to properly neutralize a POST request with an email...

CVE-2024-57590

The TRENDnet TEW-632BRP wireless router, specifically version 1.010B31 , is susceptible to an OS command injection vulnerability in the ntp_sync.cgi CGI interface. A remote attacker can execute arbitrary commands by sending a POST request to the "/ntp_sync.cgi" endpoint and manipulating the "ntp_...

CVE-2024-57595

DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apcclientpin.cgi, which allows remote attackers to execute arbitrary commands via the parameter "wpspin" passed to the apcclientpin.cgi binary through a POST request...

CVE-2024-57590: Improper Neutralization of Special Elements used in a Command

TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntpsync.cgi",which allows remote attackers to execute arbitrary commands via parameter "ntpserver" passed to the "ntpsync.cgi" binary through a POST request...

D-Link DIR-816A2 websURLFilterAddDel Component Access Control Error Vulnerability

The D-Link DIR-816A2 is a router from China's AUO D-Link. The D-Link DIR-816A2 suffers from an Access Control Error vulnerability that stems from improper access control of the websURLFilterAddDel component, which can be exploited by an unauthenticated attacker to set up filtering rules via a...

Tenda AC18 Router DoS

The vulnerability of the formSetDeviceName and subC6BB0 functions in the Tenda AC18 router’s microprogramming system lies in the possibility of copying input data into the buffer without checking its size. Exploiting this vulnerability could allow a malicious actor to cause a service failure by...

D-Link DIR-816 A2 Unauthorized Access

The vulnerability of the /goform/form2NetSniper.cgi microprogramming software for D-Link DIR-816 A2 wireless routers is related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information by sendin...

PT-2025-4073

Name of the Vulnerable Software and Affected Versions Tenda A18 versions up to 15.13.07.09 Description This issue affects the function SetCmdlineRun of the file /goform/SetCmdlineRun of the component HTTP POST Request Handler. The manipulation of the argument wpapsk crypto5g leads to stack-based...

D-Link DIR-878 Information Disclosure Vulnerability

The D-Link DIR-878 is a wireless router from China's AUO D-Link. An information disclosure vulnerability exists in the D-Link DIR-878 version 1.03, which stems from insufficient protection of sensitive information in the component HTTP POST request handler, and can be exploited by an attacker to...

CVE-2024-57677

An access control issue in the component form2Wan.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the wan service of the device via a crafted POST request...

CVE-2024-57682

An information disclosure vulnerability in the component dstatus.asp of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to access sensitive information via a crafted POST request...

CVE-2024-57683

An access control issue in the component websURLFilterAddDel of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the filter settings of the device via a crafted POST request...

CVE-2024-57680

An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request...

CVE-2024-57681

An access control issue in the component form2alg.cgi of D-Link 816A2FWv1.10CNB05R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request...

GHSA-3WG7-R7Q5-R2JF Indico Insecure Access

A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals...