CVE-2026-36803

Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the qossetting function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted HTTP request...

EUVD-2025-24632

Malicious code in bioql PyPI...

EUVD-2022-39734

Malicious code in bioql PyPI...

The vulnerability of the fromNatStaticSetting() function (/goform/NatStaticSetting) in the Tenda AC18 router software allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the fromNatStaticSetting function /goform/NatStaticSetting in the Tenda AC18 router’s microprogramming system is related to the operation that occurs outside the buffer in memory when processing the page parameter. Exploiting this vulnerability can allow an attacker to...

CVE-2023-40923

MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and savesetting parameters...

CVE-2020-36037

An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php...

CVE-2023-26978

TOTOlink A7100RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg...

CVE-2022-2092

The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks...

CVE-2022-24108

The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of deserialization of untrusted...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the SettingOPTincludepath parameter to 1 adminhelp.php; and 2 admin.incl.php, 3 reg.incl.php, 4 help.incl.php, 5 gbook.incl.php, and 6...