PT-2026-71949

Name of the Vulnerable Software and Affected Versions Baicells EG3661M version BaiCE BQ6 2.0.5.3 NA Description An OS command injection flaw exists in the LuCI Web Interface component. A remote attacker can exploit this by manipulating the MaxHops, Timeout, or Size arguments within the...

PT-2026-71938

A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly...

PT-2026-72041

Name of the Vulnerable Software and Affected Versions Webkul Bagisto versions prior to 2.4.5 Description An authorization bypass exists in the Backend Customer Detail Feature within the /admin/customers/view endpoint. A remote attacker can exploit this by manipulating the ID argument, allowing...

PT-2026-71959

A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer...

PT-2026-71954

A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save cargo type. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been...

PT-2026-72061

Name of the Vulnerable Software and Affected Versions TOTOLINK A800R version 4.1.2cu.5137 B20200730 Description A stack-based buffer overflow exists in the setRadvdCfg function within the /cgi-bin/cstecgi.cgi file of the ipv6.so component. This issue can be triggered remotely by manipulating the...

PT-2026-72049

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The...

PT-2026-71975

A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137 B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Performing a manipulation of the argument macAddress results in stack-based buffer overflow. It is possible to initiate the atta...

PT-2026-72017

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save service. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out...

PT-2026-71972

A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137 B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component product.so. This manipulation of the argument File causes stack-based buffer overflow. The attack is possible to be carried out...

PT-2026-71979

A vulnerability was identified in Tenda W20E 15.11.0.61068 1546 841 CN TDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotel...

PT-2026-72016

A weakness has been identified in Tenda W20E 15.11.0.61068 1546 841 CN TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely...

PT-2026-72062

A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137 B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the...

PT-2026-72018

Name of the Vulnerable Software and Affected Versions alldatacenter alldata versions prior to 0.6.9 Description A remote deserialization issue exists within the xxl-rpc Listener component, specifically in the Hessian2Input.readObject function located in the /serialize/impl/HessianSerializer.java...

PT-2026-72063

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137 B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The...

PT-2026-71955

Name of the Vulnerable Software and Affected Versions Tenda AC1206 version 15.03.06.23 multi TD01 Description A stack-based buffer overflow exists in the httpd web management interface. The issue occurs within the set device name function located in the '/goform/SetOnlineDevName' endpoint when th...

PT-2026-72013

Name of the Vulnerable Software and Affected Versions Tenda W20E version 15.11.0.61068 1546 841 CN TDC Description A security flaw in the QoS Rule Deletion component allows remote exploitation. A stack-based buffer overflow occurs when the qosIndex argument is manipulated within the formQOSRuleDe...

PT-2026-71957

Name of the Vulnerable Software and Affected Versions Tenda G0 versions prior to 20260625 Description A stack-based buffer overflow exists in the httpd Web Management Interface. The issue occurs within the formSetPortMirror function located in the /goform/module file when the...

PT-2026-72020

Name of the Vulnerable Software and Affected Versions wvp-GB28181-pro version 2.7.4-20260107 Description A path traversal issue exists in the Snapshot Endpoint component within the PlayController.java file. A remote attacker can exploit this by manipulating the deviceId or channelId arguments,...

CVE-2026-19758 dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely...