deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-7884
Published: 2025-07-20
Description: A vulnerability classified as problematic was found in Eluktronics Control Center 5.23.51.41. Affected by this vulnerability is an unknown functionality of the component REG File Handler. The manipulation leads to insufficient verification of data authenticity. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.3 (LOW)
CWE: CWE-345
References: https://drive.proton.me/urls/5PQ1VRZ3CG#M2JyUWapaX85; https://vuldb.com/?ctiid.316999; https://vuldb.com/?id.316999
CVE: CVE-2025-7885
Published: 2025-07-20
Description: A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-7885.md; https://github.com/huashengdun/webssh/issues/410; https://vuldb.com/?ctiid.317000
CVE: CVE-2025-7886
Published: 2025-07-20
Description: A vulnerability, which was classified as critical, was found in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. This affects the function getUserLanguage of the file classes/class.database.php. The manipulation of the argument user_id leads to sql injection. It is possible to initiate the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://asciinema.org/a/3wu3WGpnrnMc2GDvSyLUqqHUF; https://vuldb.com/?ctiid.317001; https://vuldb.com/?id.317001
CVE: CVE-2025-7887
Published: 2025-07-20
Description: A vulnerability has been found in Zavy86 WikiDocs up to 1.0.78 and classified as problematic. This vulnerability affects unknown code of the file template.inc.php. The manipulation of the argument path leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Zavy86/WikiDocs/issues/256; https://github.com/Zavy86/WikiDocs/issues/256#issue[PII_REDACTED]; https://github.com/Zavy86/WikiDocs/issues/256#issuecomment[PII_REDACTED]
CVE: CVE-2025-7888
Published: 2025-07-20
Description: A vulnerability was found in TDuckCloud tduck-platform 5.1 and classified as critical. This issue affects the function UserFormDataMapper of the file src/main/java/com/tduck/cloud/form/mapper/UserFormDataMapper.java. The manipulation of the argument formKey leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/kaixliu56/public_vulns/blob/main/TDuck-sqli.md; https://vuldb.com/?ctiid.317003; https://vuldb.com/?id.317003
CVE: CVE-2025-7889
Published: 2025-07-20
Description: A vulnerability was found in CallApp Caller ID App up to 2.0.4 on Android. It has been classified as problematic. Affected is an unknown function of the file AndroidManifest.xml of the component caller.id.phone.number.block. The manipulation leads to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/caller.id.phone.number.block.md; https://github.com/KMov-g/androidapps/blob/main/caller.id.phone.number.block.md#steps-to-reproduce; https://vuldb.com/?ctiid.317004
CVE: CVE-2025-7890
Published: 2025-07-20
Description: A vulnerability was found in Dunamu StockPlus App up to 7.62.10 on Android. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.dunamu.stockplus. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.dunamu.stockplus.md; https://github.com/KMov-g/androidapps/blob/main/com.dunamu.stockplus.md#steps-to-reproduce; https://vuldb.com/?ctiid.317005
CVE: CVE-2025-7891
Published: 2025-07-20
Description: A vulnerability was found in InstantBits Web Video Cast App up to 5.12.4 on Android. It has been rated as problematic. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.instantbits.cast.webvideo. The manipulation leads to improper export of android application components. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.instantbits.cast.webvideo.md; https://github.com/KMov-g/androidapps/blob/main/com.instantbits.cast.webvideo.md#steps-to-reproduce; https://vuldb.com/?ctiid.317006
CVE: CVE-2025-7892
Published: 2025-07-20
Description: A vulnerability classified as problematic has been found in IDnow App up to 9.6.0 on Android. This affects an unknown part of the file AndroidManifest.xml of the component de.idnow. The manipulation leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/de.idnow.md; https://github.com/KMov-g/androidapps/blob/main/de.idnow.md#steps-to-reproduce; https://vuldb.com/?ctiid.317007
CVE: CVE-2025-7893
Published: 2025-07-20
Description: A vulnerability classified as problematic was found in Foresight News App up to 2.6.4 on Android. This vulnerability affects unknown code of the file AndroidManifest.xml of the component pro.foresightnews.appa. The manipulation leads to improper export of android application components. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/pro.foresightnews.app.md; https://github.com/KMov-g/androidapps/blob/main/pro.foresightnews.app.md#steps-to-reproduce; https://vuldb.com/?ctiid.317008
CVE: CVE-2025-7894
Published: 2025-07-20
Description: A vulnerability, which was classified as critical, has been found in Onyx up to 0.29.1. This issue affects the function generate_simple_sql of the file backend/onyx/agents/agent_search/kb_search/nodes/a3_generate_simple_sql.py of the component Chat Interface. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://vuldb.com/?ctiid.317009; https://vuldb.com/?id.317009; https://vuldb.com/?submit.615322
CVE: CVE-2025-46382
Published: 2025-07-20
Description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-46383
Published: 2025-07-20
Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-46384
Published: 2025-07-20
Description: CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-46385
Published: 2025-07-20
Description: CWE-918 Server-Side Request Forgery (SSRF)
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2025-7895
Published: 2025-07-20
Description: A vulnerability, which was classified as critical, was found in harry0703 MoneyPrinterTurbo up to 1.2.6. Affected is the function upload_bgm_file of the file app/controllers/v1/video.py of the component File Extension Handler. The manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://vuldb.com/?ctiid.317010; https://vuldb.com/?id.317010; https://vuldb.com/?submit.608940
CVE: CVE-2025-7896
Published: 2025-07-20
Description: A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this vulnerability is the function download_video/delete_video of the file app/controllers/v1/video.py. The manipulation leads to path traversal. The attack can be launched remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.317011; https://vuldb.com/?id.317011; https://vuldb.com/?submit.608941
CVE: CVE-2025-7897
Published: 2025-07-20
Description: A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the file app/controllers/base.py of the component API Endpoint. The manipulation leads to missing authentication. The attack may be launched remotely.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287, CWE-306, CWE-306
References: https://vuldb.com/?ctiid.317012; https://vuldb.com/?id.317012; https://vuldb.com/?submit.609040
CVE: CVE-2025-7898
Published: 2025-07-20
Description: A vulnerability was found in Codecanyon iDentSoft 2.0. It has been classified as critical. This affects an unknown part of the file /clinica/profile/updateSetting of the component Account Setting Page. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://vuldb.com/?ctiid.317013; https://vuldb.com/?id.317013; https://vuldb.com/?submit.609578
CVE: CVE-2025-7901
Published: 2025-07-20
Description: A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. The attack may be initiated remotely.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://github.com/yangzongzhuan/RuoYi/issues/293; https://vuldb.com/?ctiid.317015; https://vuldb.com/?id.317015
CVE: CVE-2025-7902
Published: 2025-07-20
Description: A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/yangzongzhuan/RuoYi/issues/294; https://github.com/yangzongzhuan/RuoYi/issues/294#issue[PII_REDACTED]; https://vuldb.com/?ctiid.317016
CVE: CVE-2025-7903
Published: 2025-07-20
Description: A vulnerability classified as problematic was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is an unknown functionality of the component Image Source Handler. The manipulation leads to improper restriction of rendered ui layers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://github.com/yangzongzhuan/RuoYi/issues/295; https://vuldb.com/?ctiid.317017; https://vuldb.com/?id.317017
CVE: CVE-2025-7904
Published: 2025-07-20
Description: A vulnerability, which was classified as critical, was found in itsourcecode Insurance Management System 1.0. This affects an unknown part of the file /insertNominee.php. The manipulation of the argument nominee_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/viaiam/CVE/issues/1; https://itsourcecode.com/; https://vuldb.com/?ctiid.317019
CVE: CVE-2025-48965
Published: 2025-07-20
Description: Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-696, CWE-476
References: https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-6.md; https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/; https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html
CVE: CVE-2025-47917
Published: 2025-07-20
Description: Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).
CVSS Score: 8.9 (HIGH)
CWE: CWE-416
References: https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-7.md; https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/; https://lists.debian.org/debian-lts-announce/2025/08/msg00013.html
CVE: CVE-2025-49087
Published: 2025-07-20
Description: In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padding mode is used.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-385
References: https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-5.md; https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
CVE: CVE-2025-54316
Published: 2025-07-20
Description: An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in filter functions to generate XSS payloads. These payloads can be rendered by the Logpoint Report Template engine, making it vulnerable to cross-site scripting (XSS) attacks.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-79
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]4317-XSS-vulnerability-in-Report-Templates-using-built-in-Jinja-filter-functions; https://servicedesk.logpoint.com/hc/en-us/sections/[PII_REDACTED]845-Product-Security
CVE: CVE-2025-54317
Published: 2025-07-20
Description: An issue was discovered in Logpoint before 7.6.0. An attacker with operator privileges can exploit a path traversal vulnerability when creating a Layout Template, which can lead to remote code execution (RCE).
CVSS Score: 8.4 (HIGH)
CWE: CWE-23
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]5549-Path-Traversal-in-Layout-Templates-Allows-Remote-Code-Execution; https://servicedesk.logpoint.com/hc/en-us/sections/[PII_REDACTED]845-Product-Security
CVE: CVE-2025-7905
Published: 2025-07-20
Description: A vulnerability has been found in itsourcecode Insurance Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /insertPayment.php. The manipulation of the argument recipt_no leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/viaiam/CVE/issues/2; https://itsourcecode.com/; https://vuldb.com/?ctiid.317020
CVE: CVE-2025-7906
Published: 2025-07-20
Description: A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1 and classified as critical. This issue affects the function uploadFile of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/yangzongzhuan/RuoYi/issues/296; https://vuldb.com/?ctiid.317021; https://vuldb.com/?id.317021
CVE: CVE-2025-54319
Published: 2025-07-20
Description: An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive information via system logging information (syslog verbose logging that includes credentials).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-532
References: https://www.westermo.com/-/media/Files/Cyber-security/westermo_sa_25-08_sensitive_information_in_logging.pdf?rev=40c4e78bd1524f639a89cd1b005e0f23&hash=64987A18FFECA633F23DB11FE5EAFA9A; https://www.westermo.com/uk/support/security-advisories
CVE: CVE-2025-7907
Published: 2025-07-20
Description: A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been classified as problematic. Affected is an unknown function of the file ruoyi-admin/src/main/resources/application-druid.yml of the component Druid. The manipulation leads to use of default credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1392
References: https://github.com/yangzongzhuan/RuoYi/issues/297; https://vuldb.com/?ctiid.317022; https://vuldb.com/?id.317022
CVE: CVE-2025-7908
Published: 2025-07-20
Description: A vulnerability was found in D-Link DI-8100 1.0. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file /ddns.asp?opt=add of the component jhttpd. The manipulation of the argument mx leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/buobo/bo-s-CVE/blob/main/DI-8100/wp.md; https://vuldb.com/?ctiid.317023; https://vuldb.com/?id.317023
CVE: CVE-2025-7909
Published: 2025-07-20
Description: A vulnerability was found in D-Link DIR-513 1.0. It has been rated as critical. Affected by this issue is the function sprintf of the file /goform/formLanSetupRouterSettings of the component Boa Webserver. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/buobo/bo-s-CVE/blob/main/DIR-513/formLanSetupRouterSettings.md; https://vuldb.com/?ctiid.317024; https://vuldb.com/?id.317024
CVE: CVE-2025-7910
Published: 2025-07-20
Description: A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function sprintf of the file /goform/formSetWanNonLogin of the component Boa Webserver. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/buobo/bo-s-CVE/blob/main/DIR-513/formSetWanNonLogin.md; https://vuldb.com/?ctiid.317025; https://vuldb.com/?id.317025
CVE: CVE-2025-53771
Published: 2025-07-20
Description: Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771; https://www.bleepingcomputer.com/news/microsoft/microsoft-sharepoint-zero-day-exploited-in-rce-attacks-no-patch-available/
CVE: CVE-2025-7911
Published: 2025-07-20
Description: A vulnerability classified as critical was found in D-Link DI-8100 1.0. This vulnerability affects the function sprintf of the file /upnp_ctrl.asp of the component jhttpd. The manipulation of the argument remove_ext_proto/remove_ext_port leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/buobo/bo-s-CVE/blob/main/DI-8100/upnp_ctrl_asp.md; https://vuldb.com/?ctiid.317026; https://vuldb.com/?id.317026
CVE: CVE-2025-7912
Published: 2025-07-20
Description: A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B20211015. This issue affects the function recvSlaveUpgstatus of the component MQTT Service. The manipulation of the argument s leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/6.md; https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/6.md#poc; https://vuldb.com/?ctiid.317027
CVE: CVE-2025-7913
Published: 2025-07-21
Description: A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. Affected is the function updateWifiInfo of the component MQTT Service. The manipulation of the argument serverIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/7.md; https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/7.md#poc; https://vuldb.com/?ctiid.317028
CVE: CVE-2025-7914
Published: 2025-07-21
Description: A vulnerability has been found in Tenda AC6 15.03.06.50 and classified as critical. Affected by this vulnerability is the function setparentcontrolinfo of the component httpd. The manipulation leads to buffer overflow. The attack can be launched remotely.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/gaochen61/IoTVuln/blob/main/Tenda_AC6_V15.03.06.50/setparentcontrolinfo.md; https://vuldb.com/?ctiid.317029; https://vuldb.com/?id.317029