CVE-2025-59452

The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50...

CVE-2025-59448

Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain sensitive information or tamper with the traffic to control affected devices. This affects YoLin...

YoSmart YoLink API 安全漏洞

The YoSmart YoLink API is a smart home management interface from YoSmart USA. A security vulnerability exists in the YoSmart YoLink API that stems from the use of endpoint URLs based on device MAC addresses and MD5 hashes, which could lead to information disclosure...

YoSmart YoLink MQTT broker 安全漏洞

YoSmart YoLink MQTT broker is a messaging proxy server from YoSmart USA. A security vulnerability exists in YoSmart YoLink MQTT broker version 2025-10-02 and earlier, which stems from insufficient authorization controls and could lead to cross-account attacks...

CVE-2025-59450

The CVE-2025-59450 entry concerns YoSmart YoLink Smart Hub firmware 0382 (unencrypted). The documented impact is that data extracted from the device could be used to determine network access credentials, exposing confidentiality. No exploitation details are provided in the supplied documents. Rem...

CVE-2025-59450

The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials...

CVE-2025-59451

The connected sources confirm CVE-2025-59451 affects the YoSmart YoLink ecosystem: the YoLink MQTT broker and the YoLink API (through 2025-10-02) use session tokens with unexpectedly long lifetimes, enabling persistent unauthorized access. CISA’s advisory details additional risks tied to this vul...

CVE-2025-59452: Generation of Predictable Numbers or Identifiers

The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50...

CVE-2025-59451: Incorrect Authorization

The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes...

CVE-2025-59448: Cleartext Transmission of Sensitive Information

Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain sensitive information or tamper with the traffic to control affected devices. This affects YoLin...

$20 YoLink IoT Gateway Vulnerabilities Put Home Security at Risk

Four critical zero-day flaws found in the $20 YoLink Smart Hub allow remote physical access, threatening your home security. See the urgent steps you must take now...

WordPress yolink Search Plugin <= 2.5 - Cross-Site Scripting

This plugin is prone to a cross site scripting vulnerability via "s" parameter. Solution Update the plugin...

WordPress yolink Search plugin <= 1.1.4 - SQL Injection

No description provided by source. Exploit Title: WordPress yolink Search plugin = 1.1.4 SQL Injection Vulnerability Date: 2011-08-30 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/yolink-search.1.1.4.zip Version: 1.1.4 tested...

WordPress Yolink Search 1.1.4 SQL Injection

Exploit Title: WordPress yolink Search plugin getresults $wpdb-prepare "SELECT ID,GUID FROM $wpdb-posts WHERE poststatus='publish' AND posttype IN $posttypein AND ID $idfrom order by ID asc LIMIT $batchsize" ; //misusage of $wpdb-prepare :...

WordPress yolink Search Plugin <= 1.1.4 - SQL Injection

This WordPress yolink Search plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...

WordPress Plugin yolink Search 1.1.4 - SQL Injection

Exploit Title: WordPress yolink Search plugin getresults $wpdb-prepare "SELECT ID,GUID FROM $wpdb-posts WHERE poststatus='publish' AND posttype IN $posttypein AND ID $idfrom order by ID asc LIMIT $batchsize" ; //misusage of $wpdb-prepare :...