CVE-2026-51672

CVE-2026-51672 is an incorrect access control flaw in the getRoamingCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated remote attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to obtain the roaming enablement flag, resulting in information ...

CVE-2026-51673

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84040

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.5 pnpm versions prior to 11.11.0 Description pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because the pickPackage.ts function rejects slash characters only for unscoped...

Medium: python-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Medium: python3.13-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

CVE-2026-51712

Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter wireless availability windows via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68585

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83810

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to modify language configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83820

A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive...

CVE-2026-51713

Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51717

Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change the device operating mode via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68586

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51719

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83829

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51706

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51717

TOTOLINK T6 firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the setOpModeCfg function, allowing unauthenticated attackers to change the device's operating mode by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.1 (Critical) with high con...

PT-2026-83875

Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to reconfigure primary Wi-Fi settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83874

Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change WPS availability via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83975

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The...

PT-2026-84044

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check img type of the file admin/pack.php. Executing a manipulation of the argument pack img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to...