CVE-2006-3991

A vulnerability was found in D-Link DIR-822A A_101 in the strcpy function of the file udhcpcd/serverpacket.c in the udhcpcd component. This manipulation causes a stack-based buffer overflow. The attack can be carried out remotely and the exploit is publicly disclosed.

A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in the nodered_lib_apply function of the Node-RED Library component. Manipulation of the argument act leads to command injection. The attack can be launched remotely and the exploit is publicly available. The vendor released a fix in version 1.2.4_20260821.

A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in the basicstation_apply function of the Basic Station Certificate-Deletion Handler component. Manipulation of the argument act causes command injection. The attack can be initiated remotely and the exploit is publicly disclosed. The vendor released a fix in version 1.2.4_20260821.

An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet.

A vulnerability was identified in Tenda HG10 (version 300001138) in the formgponConf function of the /boaform/admin/formgponConf file in the Boa component. Manipulation of the fmgpon_loid argument leads to OS command injection. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was found in Tenda HG10 (version 300001138) in the formURL function of the /boaform/admin/formURL file. Manipulation of the Keywd/urlFQDN arguments results in a buffer overflow. The attack can be initiated remotely, and the exploit has been made public.

N-central is vulnerable to pre-auth remote code execution. This issue affects N-central before version 2026.3.1.14.

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to and including 3.29.12. The pre_update_value function lacks capability or ownership checks, and ActionPost::conditions_logic() short-circuits the current_user_can('edit_post') authorization gate when the post ID is non-numeric, allowing unauthenticated form submissions to be routed to arbitrary user records. This enables unauthenticated attackers to overwrite any user's email address, including an administrator's, and then use WordPress's native password-reset flow to take over the account.

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.8.5 via the 'id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification to the victim.

A vulnerability has been found in Tenda CP3 (version 27.5.57.101) in the CRedirServer::SetRedirectEnable function of the Functions/Redirect.cpp file. The manipulation leads to improper privilege management. Remote exploitation is possible.