CVE-2026-51725: Improper Access Control

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51722: Improper Access Control

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51720: Improper Access Control

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-81278: Missing Authorization

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

CVE-2026-75458: Authorization Bypass Through User-Controlled Key

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

CVE-2026-51736: Improper Access Control

Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51686: Improper Access Control

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51684: Improper Access Control

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51681: Improper Access Control

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51678: Improper Access Control

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51669: Improper Access Control

Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain pairing and mesh-slave configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51666: Improper Access Control

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68536

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83934

Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68751

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve recent system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51734

Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83854

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51671

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51726

Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51675: Improper Access Control

Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...