CVE-2026-85117

A vulnerability was detected in TOTOLINK CA300-PoE version 6.2c.884 in the UploadCustomModule function of the file /cgi-bin/cstecgi.cgi. Manipulation of the File argument results in a buffer overflow. The attack can be launched remotely, and the exploit is now public and may be used.

A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. The function setWiFiWdsAddConfig in the file /cgi-bin/cstecgi.cgi is affected, where manipulation of the ApCliKeyStr argument leads to a buffer overflow. The attack may be initiated remotely, and the exploit has been disclosed publicly and may be used.

A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. The function setWiFiRepeaterConfig in the file /cgi-bin/cstecgi.cgi is affected, where manipulation of the ApCliKeyStr argument can lead to a buffer overflow. The attack can be launched remotely, and the exploit has been made available to the public and could be used for attacks.

A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi. Manipulation of the argument Key1Str1 results in a buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was found in Tenda AC19 version 16.03.10.07 in the saveParentControlInfo function of the /goform/saveParentControlInfo file. Manipulating the deviceId argument causes a heap-based buffer overflow. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during setup. An authenticated attacker with client management permissions can bypass security controls and upload a malicious JavaScript policy that executes on the server.

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress up to and including 3.8.0 is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function. The handler is registered for both wp_ajax and wp_ajax_nopriv and gated solely by the 'file_handling_nonce' nonce, which is exposed in the public checkout page markup.

The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in FormHandler::validate_checkout_fields() in versions up to and including 1.1.4. The checkout registration path stores the raw $_POST['user_roles'] value without validation, and add_user_data() injects it as the new account's role.

The LatePoint plugin for WordPress is vulnerable to authentication bypass via account takeover in versions up to and including 5.7.6. OsModel::build_conditions_query() compares WHERE-clause values against literal strings 'IS NULL' and 'IS NOT NULL' and concatenates a match directly into SQL without binding, allowing unauthenticated attackers to send params[password_reset_token]=IS NOT NULL to the public customer_cabinet__change_password AJAX route and overwrite the lowest-id customer's password.

The Naimur Email OTP Verification for WooCommerce plugin is vulnerable to authentication bypass in versions up to and including 2.1.0. The password-reset finalization endpoint authorizes the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, session binding, or per-reset token, and the scheduled cleanup cron has no handler so it never runs.