NETGEAR WG302v2 Command Injection Vulnerability

The NETGEAR WG302v2 is a wireless access point from NETGEAR. The NETGEAR WG302v2 suffers from a command injection vulnerability that stems from the uigetinputvalue function parameter host failing to properly filter constructor command special characters, commands, and so on. No details of the...

ERPNext Cross-Site Request Forgery Vulnerability

ERPNext is an open source enterprise resource planning solution from ERPNext India. ERPNext suffers from a cross-site request forgery vulnerability that can be exploited by attackers to cause unauthorized operations...

Google ChromeOS Out-of-Bounds Read Vulnerability

Google ChromeOS is an operating system from the American company Google. Google ChromeOS suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to cause a virtual machine to escape...

Tenda RX2 Pro Information Disclosure Vulnerability

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. The Tenda RX2 Pro suffers from an information disclosure vulnerability that originates from the explicit transmission of sensitive information in the web management portal, which can be exploited by an attacker to decry...

NETGEAR EX6200 sub_3C03C Function Buffer Overflow Vulnerability

NETGEAR EX6200 is a wireless network signal extender from NETGEAR. The NETGEAR EX6200 suffers from a buffer overflow vulnerability, which originates from the sub3C03C function parameter host failing to correctly validate the length of the input data, which can be exploited by an attacker to execu...

PCMan FTP Server MDIR Command Handler Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. PCMan FTP Server suffers from a buffer overflow vulnerability that originates from the MDIR command handler failing to properly validate the length of input data, which can be exploited by an attacker to cause a denial of service...

PCMan FTP Server TYPE Command Handler Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. PCMan FTP Server suffers from a buffer overflow vulnerability that originates from the TYPE command handler failing to properly validate the length of input data, which can be exploited by an attacker to cause a denial of service...

TOTOLINK CA600-PoE setUpgradeFW Function Command Injection Vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the setUpgradeFW function failing to properly filter construct command special characters, commands, etc. No detailed...

NETGEAR EX6200 sub_3D0BC Function Buffer Overflow Vulnerability

NETGEAR EX6200 is a wireless network signal extender from NETGEAR. The NETGEAR EX6200 suffers from a buffer overflow vulnerability that originates from the sub3D0BC function parameter host failing to properly validate the length of the input data, which can be exploited by an attacker to execute...

NETGEAR EX6200 sub_47F7C Function Buffer Overflow Vulnerability

NETGEAR EX6200 is a wireless network signal extender from NETGEAR. The NETGEAR EX6200 suffers from a buffer overflow vulnerability that originates from the sub47F7C function parameter host failing to properly validate the length of input data, which can be exploited by an attacker to execute...

Microsoft Edge (Chromium-based) Spoofing Vulnerability (CNVD-2025-13268)

Microsoft Edge is a web browser from the American company Microsoft that comes with systems after Windows 10. Microsoft Edge suffers from a spoofing vulnerability that can be exploited by attackers to conduct spoofing attacks when visiting specially crafted websites...

TOTOLINK CA600-PoE CloudSrvUserdataVersionCheck function magicid parameter command injection vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the failure of the magicid parameter of the CloudSrvUserdataVersionCheck function to correctly filter constructed command...

TOTOLINK CP900 setUpgradeUboot Function Command Injection Vulnerability

The TOTOLINK CP900 is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK CP900 suffers from a command injection vulnerability that stems from the setUpgradeUboot function failing to properly filter constructor command special characters, commands, etc. No detailed vulnerabilit...

WordPress Awesome Gallery plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Awesome Gallery plugin, which stems from the application's lack of effective filtering and escaping of user-supplied...

PCMan FTP Server LIST Command Handler Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. PCMan FTP Server suffers from a buffer overflow vulnerability that originates from the LIST command handler failing to correctly validate the length and size of input data, which can be exploited by an attacker to cause a denial of...

Tenda AC8 Buffer Overflow Vulnerability (CNVD-2025-09923)

Tenda AC8 is a wireless router from Tenda, a Chinese company. Tenda AC8 suffers from a buffer overflow vulnerability, which originates from the parameter shareSpeed in /goform/MtuSetMacWan that fails to correctly validate the length and size of the input data, which can be exploited by an attacke...

Cyber Cafe Management System adminprofile.php File SQL Injection Vulnerability

Cyber Cafe Management System is an internet cafe management system. Cyber Cafe Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter mobilenumber in the file /adminprofile.php. An attacker can...

Dell Storage Manager Path Traversal Vulnerability

Dell Storage Manager is a centralized storage management platform from Dell that supports the configuration, monitoring and automated operation and maintenance of the full range of Dell EMC storage systems. A path traversal vulnerability exists in Dell Storage Manager, which stems from an...

Tenda DAP-1520 set_ws_action function buffer overflow vulnerability

Tenda DAP-1520 is a dual-band wireless access point from Tenda China. The Tenda DAP-1520 suffers from a buffer overflow vulnerability, which originates from the failure of the function setwsaction in the file /dws/api to correctly validate the length of the input data, which can be exploited by a...

D-Link DIR-600L formSysCmd Function Command Injection Vulnerability

The D-Link DIR-600L is an entry-level wireless router from China-based AUO D-Link that supports 150Mbps wireless transmission and four 100Gbps wired ports. The D-Link DIR-600L suffers from a command injection vulnerability that stems from the formSysCmd function parameter host failing to properly...

D-Link DIR-600L formEasySetupWizard function buffer overflow vulnerability

The D-Link DIR-600L is a wireless router from China-based AUO D-Link. The D-Link DIR-600L suffers from a buffer overflow vulnerability that originates from the parameter host of the function formEasySetupWizard that fails to correctly validate the length and size of the input data, which can be...

D-Link DIR-890L/DIR-806A1 Command Injection Vulnerability

D-Link DIR-890L and D-Link DIR-806A1 are both products of China's AUO D-Link.D-Link DIR-890L is a wireless router.D-Link DIR-806A1 is a dual-band wireless router that supports AC750 wireless rate and USB sharing function. The D-Link DIR-890L and D-Link DIR-806A1 suffer from a command injection...

Cisco IOS Access Control Error Vulnerability (CNVD-2025-15478)

Cisco IOS is the United States Cisco Cisco company's set of operating system developed for its network equipment. Cisco IOS suffers from an Access Control Error vulnerability that stems from a misconfiguration of access control lists, which can be exploited by an attacker to cause bypassing of AC...

WordPress Accept Donations with PayPal plugin Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Accept Donations with PayPal plugin, which stems from the WEB application not adequately verifying that a...

D-Link DIR-880L /htdocs/ssdpcgi File Command Injection Vulnerability

The D-Link DIR-880L is a dual-band Gigabit wireless router from China's AUO D-Link. The D-Link DIR-880L suffers from a command injection vulnerability, which arises from the failure of the file /htdocs/ssdpcgi in the component Request Header Handler to correctly filter the constructed command...

TOTOLINK CA600-PoE CloudSrvUserdataVersionCheck function version parameter command injection vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the CloudSrvUserdataVersionCheck function version parameter failing to correctly filter the constructor command special...

Tenda RX2 Pro Access Control Error Vulnerability

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. The Tenda RX2 Pro suffers from an access control error vulnerability that can be exploited by an attacker to enable ate management binary...

TOTOLINK CPE CP900 setUploadUserData Function Command Injection Vulnerability

TOTOLINK CPE CP900 is an outdoor wireless CPE device from China Gion Electronics TOTOLINK. The TOTOLINK CPE CP900 suffers from a command injection vulnerability that stems from the setUploadUserData function failing to properly filter construct command special characters, commands, etc. No detail...

D-Link DIR-600L formSetWanL2TP function buffer overflow vulnerability

The D-Link DIR-600L is an entry-level wireless router from China's AUO D-Link that supports 150Mbps wireless transmission and four 100 megabit wired ports. The D-Link DIR-600L suffers from a buffer overflow vulnerability that stems from the formSetWanL2TP function parameter host failing to proper...

TOTOLINK CA600-PoE setWebWlanIdx Function Command Injection Vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the setWebWlanIdx function failing to properly filter construct command special characters, commands, etc. No detailed...

TOTOLINK A720R Access Control Error Vulnerability

TOTOLINK A720R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A720R suffers from an Access Control Error vulnerability that originates from improper handling of the parameter topicurl in the file /cgi-bin/cstecgi.cgi, which can be exploited by an attacker to cause...

WordPress Advanced File Manager plugin missing license vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A lack of authorization vulnerability exists in the WordPress Advanced File Manager plugin that stems from a lack of authorization and can be exploited by an attacker to modify...

Student Record System add-course.php File SQL Injection Vulnerability

Student Record System is a software application. Student Record System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter course-short in the file /add-course.php. An attacker can exploit this vulnerability to...

IBM Concert Software Encryption Issues Vulnerabilities

IBM Concert Software is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. IBM Concert Software suffers from a cryptographic issue vulnerability that stems from the use of weak encryption algorithms, which could be...

Patient Record Management System edit_xpatient.php File SQL Injection Vulnerability

Patient Record Management System is a medical record management system. Patient Record Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter lastname in the file /editxpatient.php. An attacker...

PCMan FTP Server 'ASCII' Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. PCMan FTP Server 'ASCII exists' buffer overflow vulnerability, the vulnerability stems from the ASCII command handler fails to properly validate the length size of the input data, an attacker can use this vulnerability to execute...

IBM i Trust Management Issues Vulnerabilities

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. IBM i is vulnerable to a trust management issue vulnerability that stems from improper handling of IBM i Netserver authentication, no details of the vulnerability are...

TOTOLINK CA300-PoE Command Injection Vulnerability (CNVD-2025-10607)

TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. TOTOLINK CA300-PoE has a command injection vulnerability, the vulnerability stems from the recvUpgradeNewFw function fwUrl parameter fails to correctly filter the construction of the command special characters,...

Tenda DAP-1520 mod_graph_auth_uri_handler function buffer overflow vulnerability

Tenda DAP-1520 is a dual-band wireless access point from Tenda China. The Tenda DAP-1520 suffers from a buffer overflow vulnerability that originates from the failure of the modgraphauthurihandler function in file/storage to properly validate the length of the input data, which could be exploited...

WordPress aBlocks plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress aBlocks plugin, which stems from the application's lack of effective filtering and escaping of user-supplied data, and n...

Art Gallery Management System /admin/add-art-medium.php File SQL Injection Vulnerability

Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter artmed in the file /admin/add-art-medium.php. An attacker c...

IBM Cloud Pak for Business Automation Denial of Service Vulnerability

IBM Cloud Pak for Business Automation is a modular set of integrated software components from International Business Machines IBM, built for any hybrid cloud, designed to automate work and accelerate business growth. A denial of service vulnerability exists in IBM Cloud Pak for Business Automatio...

PCMan FTP Server HASH Command Handler Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. PCMan FTP Server suffers from a buffer overflow vulnerability that originates from the HASH command handler failing to properly validate the length of input data, which can be exploited by an attacker to cause a denial of service...

D-Link DIR-600L formSetWAN_Wizard534 Function Buffer Overflow Vulnerability

The D-Link DIR-600L is an entry-level wireless router from China's AUO D-Link that supports 150Mbps wireless transmission and four 100 megabit wired ports. The D-Link DIR-600L suffers from a buffer overflow vulnerability that originates from the parameter host of the formSetWANWizard534 function...

Tenda W20E formSetDebugCfg function enable parameter command injection vulnerability

The Tenda W20E is a router from the Chinese company Tenda. The Tenda W20E suffers from a command injection vulnerability that stems from the formSetDebugCfg function enable parameter failing to properly filter construct command special characters, commands, and so on. No detailed vulnerability...

PCMan FTP Server LS Command Handler Buffer Overflow Vulnerability

PCMan FTP Server is PCMan open source set of FTP server software. PCMan FTP Server suffers from a buffer overflow vulnerability that originates from the LS command handler failing to properly validate the length and size of input data, which can be exploited by an attacker to cause a denial of...

WordPress Ajax Load More plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Ajax Load More plugin, which stems from the application's lack of effective filtering and escaping of user-supplied...

Tenda RX2 Pro Information Disclosure Vulnerability

Tenda RX2 Pro is a high performance WiFi 6 signal amplifier from Tenda China. The Tenda RX2 Pro suffers from an information disclosure vulnerability that can be exploited by an attacker to collect credentials for authentication...

Linux kernel memory leak vulnerability (CNVD-2025-10174)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a memory leak vulnerability that stems from nfcmrvli2cncisend not freeing the skb, which could lead to a memory leak. No details of the vulnerability...

Park Ticketing Management System HTML Injection Vulnerability

Park Ticketing Management System is a park ticketing management system. Park Ticketing Management System suffers from an HTML injection vulnerability that stems from the mishandling of the searchdata parameter in the normal-search.php file, resulting in an HTML injection attack. No details of the...