CVE Vulnerability Catalog

Incorrect access control in the UploadCustomModule function of TOTOLINK T6 allows unauthenticated attackers to install a custom CGI module via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 allows unauthenticated attackers to repoint the device to an attacker-controlled upstream Wi-Fi via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setPairCfg function of TOTOLINK T6 allows unauthenticated attackers to alter the mesh pairing state via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove firewall filter rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

The Silicon Labs SiWx917 WiFi driver's siwx91x_send() function frees a network packet it does not own. In the Zephyr TX path, the net_pkt is owned by the L2/networking stack; the driver only borrows it. Before the fix, the driver called net_pkt_unref(pkt) on the caller-owned packet, prematurely returning it to the shared packet pool.

Kubio AI Website Builder before version 2.9.1 has an improper input validation vulnerability. This could allow an attacker to inject unexpected data, potentially leading to unintended consequences.

This CVE has been rejected. Do not use it. It is a reservation duplicate of CVE-2026-82814. All references and descriptions have been removed to prevent accidental usage.

A vulnerability was found in ieungSoft Ultra RAMDisk Pro 1.82 in the kernel driver URDSCSI.sys. Manipulation leads to improper privilege management. The attack requires local access, and the exploit has been publicly disclosed.

A cross-site scripting (XSS) vulnerability was found in Typora up to 1.13.8/1.14.6 in the Mermaid Rendering Engine. Manipulating the classDef/style argument leads to XSS. The attack can be launched remotely and the exploit is public. The vendor released a fix in version 1.14.8.

A null pointer dereference vulnerability was found in struct2json 1.0 in the S2J_STRUCT_GET_string_ELEMENT function during JSON deserialization. Manipulating the valuestring argument can cause a crash. The attack can be initiated remotely and the exploit is public. The vendor did not respond.

A server-side request forgery (SSRF) vulnerability was found in NASA earthdata-search 1.0.0 in the OpenSearchGranuleSearchLambda function. Manipulating the openSearchOsdd argument can allow sending requests to arbitrary resources. The attack can be launched remotely and the exploit is public. The vendor did not respond.

The affected Ebyte product exports administrative credentials and other sensitive configuration information without adequate protection. An unauthenticated attacker on the adjacent network who obtains an exported configuration file could recover valid credentials and use them to access the device or similarly configured systems.

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings affecting confidentiality, integrity, or availability.

The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate unauthorized access.

The Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump via the publicly exposed `kbd_cron_process` parameter. Attackers can predict the dump filename and download the backup from the public uploads directory.

WAPT Server versions 2.6.1.17834 and earlier contain a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions, bypass host scope restrictions, and read information from other rows or tables.

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventing legitimate administrators from managing the device.

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove URL filtering rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to remove static DHCP reservations via a crafted POST request to /cgi-bin/cstecgi.cgi.