CVE-2026-51717

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83891

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51717

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51740

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51672

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51687

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51679

The TOTOLINK T6 wireless dual-band Mesh router (firmware version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control flaw within the setPasswordCfg function. An unauthenticated attacker can exploit this by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoi...

CVE-2026-75460: Authorization Bypass Through User-Controlled Key

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

CVE-2026-51740: Improper Access Control

Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to terminate critical services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51668: Improper Access Control

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51712

The TOTOLINK T6 wireless dual-band Mesh router is affected by a vulnerability in the setApWiFiSchCfg function. Due to improper access control , an unauthenticated attacker can alter wireless availability windows by sending a crafted POST request to /cgi-bin/cstecgi.cgi. This issue specifically im...

CVE-2026-51695: Improper Access Control

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-56718

creationtimestamp| type| source ---|---|--- 2026-08-30 20:46:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gjr6e32eybwj7 2026-08-30 20:49:29+00:00| seen| https://bsky.app/profile/suriq.io/post/3mudbczrzqb2f 2026-08-30 23:22:56+00:00| seen|...

CVE-2026-82556

creationtimestamp| type| source ---|---|--- 2026-08-30 18:34:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3shvhizps2ufc...

CVE-2026-82644

creationtimestamp| type| source ---|---|--- 2026-08-30 16:03:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucrd7jjo722...

CVE-2026-82636

creationtimestamp| type| source ---|---|--- 2026-08-30 15:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucnuh3gnn2z 2026-08-30 18:09:50+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mucyfq3wqy2q 2026-08-30 18:09:53+00:00| seen|...

CVE-2026-82544

creationtimestamp| type| source ---|---|--- 2026-08-30 14:34:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/baujrtrh3e6m6...

CVE-2026-82641

creationtimestamp| type| source ---|---|--- 2026-08-30 14:26:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eppzem5eiti2r 2026-08-30 15:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucntzdfan2t 2026-08-31 04:02:56+00:00| seen|...

CVE-2026-55552

creationtimestamp| type| source ---|---|--- 2026-08-30 11:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucafrkawq2o 2026-10-05 06:12:25+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-55552.yaml...

CVE-2026-82483

creationtimestamp| type| source ---|---|--- 2026-08-30 10:14:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3oz7m7fecgazc 2026-08-30 12:15:03+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-82483...