CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.23)
An OS command injection vulnerability was discovered in iBSG v3.5 by N.V.K.INTER CO., LTD. (NVK). The flaw exists in the system_hostname parameter at /manage/network-basic.php, allowing shell metacharacters to be injected.
A hardcoded root password was discovered in N.V.K.INTER CO., LTD. (NVK) iBSG v3.5. This allows attackers to log in with root privileges via SSH.
A SQL injection vulnerability was discovered in iBSG v3.5 by N.V.K.INTER CO., LTD. (NVK) via the a_passwd parameter at /portal/user-register.php. This flaw allows an attacker to manipulate database queries.
There is an OS command injection vulnerability in ELECOM wireless LAN routers that allows an attacker to execute arbitrary OS commands by sending a specially crafted request. This affects all versions of models WRC-F1167ACF, WRC-1750GHBK, WRC-1167GHBK2, WRC-1750GHBK2-I, and WRC-1750GHBK-E.
A buffer overflow vulnerability exists in ELECOM wireless LAN routers, which may allow an unauthenticated attacker to execute arbitrary code.
A hidden functionality vulnerability in LOGITEC wireless LAN routers allows an unauthenticated attacker to log in to the product's certain management console and execute arbitrary OS commands.
A buffer overflow vulnerability was discovered in the D-Link DIR-880 A1_FW107WWb08 device via the fgets function.
The Tenda AC15 V1.0BR_V15.03.05.18_multi_TD01 device was found to contain a buffer overflow vulnerability in the function FUN_00010e34().
Version 1.0.0.18 of the Tenda WH450 has a buffer overflow vulnerability in the fgets function.
A buffer overflow vulnerability was discovered in D-Link DIR-880 A1_FW107WWb08 via the function FUN_0001be68.
The Tenda AC6 _US_AC6V1.0BR_V15.03.05.16 device was found to contain a buffer overflow vulnerability in the fgets function.
The D-Link DIR-868L with firmware version fw_revA_1-12_eu_multi_20170316 was found to contain a buffer overflow in the inet_ntoa() function via the param_2 parameter.
D-Link DIR-868L with firmware version fw_revA_1-12_eu_multi_20170316 was found to contain a buffer overflow vulnerability in the FUN_0000acb4 function via the param_2 parameter.
D-Link DIR-842 with firmware version fw_revA_1-02_eu_multi_20151008 was found to contain multiple buffer overflows in the fgets function triggered by the acStack_120 and acStack_220 parameters.
D-Link DIR-868L with firmware version fw_revA_1-12_eu_multi_20170316 was found to contain a buffer overflow via the acStack_50 parameter.
A vulnerability in the Dispatch tool allows the JWT secret key to be exposed in error messages, potentially leading to account takeover for users relying on the `Dispatch Plugin - Basic Authentication Provider`.
CVE-2023-39970 vulnerability affects the AcyMailing component for Joomla, allowing unrestricted upload of files with dangerous types, leading to remote code execution.
CVE-2023-36845 is a PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS that allows an unauthenticated, network-based attacker to remotely execute code by modifying the PHPRC variable. This enables code injection and execution in the PHP execution environment.
XWiki Platform allows users who can view `Invitation.WebHome` to execute arbitrary script macros, including Groovy and Python, leading to remote code execution. This vulnerability allows unrestricted read and write access to all wiki contents.
An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.