WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Anthony Green of Greenhat Security in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.23...

CVE-2026-84477

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

CVE-2026-84477

AVideo is vulnerable to a stored XSS in its live scheduling feature. The functions Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can subsequently access remindMe...

CVE-2026-51733

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51732

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51703

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51703

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51732

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51733

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51733

An incorrect access control flaw in the FirmwareUpgrade function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows an unauthenticated remote attacker to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability is rated CVSS 9.8 (CR...

EUVD-2026-68753

Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68754

Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51732

An incorrect access control flaw in the delWiFiScheduleCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers to remove Wi-Fi schedule entries by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 5.3 (Medium) with a ne...

PT-2026-83962

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the FirmwareUpgrade function allows unauthenticated attackers to remove Wi-Fi schedule entries. This is achieved by sending a crafted POST request to the...

CVE-2026-51703

An incorrect access control flaw in the setWiFiScheduleCfg function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015 ) allows unauthenticated attackers on the adjacent network to alter Wi-Fi availability schedules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability carries ...

EUVD-2026-68646

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51654

CVE-2026-51654 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An incorrect access control flaw in the getScheduleCfg function allows unauthenticated attackers on the adjacent network to send a crafted POST request to /cgi-bin/cstecgi.cgi, thereby retrieving schedule or sc...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring: add a schedule point in ioaddbuffers Looping 65535 times doing kmalloc calls can trigger soft lockups, especially with DEBUG features like KASAN. 253.536212 watchdog: BUG: soft lockup - CPU64 stuck for 26s!...