rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-31503 
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-16T00:00:00.000Z
CVE-2024-31504 
Buffer Overflow vulnerability in SILA Embedded Solutions GmbH freemodbus v.2018-09-12 allows a remtoe attacker to cause a denial of service via the LINUXTCP server component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-08T00:00:00.000Z
CVE-2024-31506 
Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "id" parameter in admin/admin_cs.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-09T00:00:00.000Z
CVE-2024-31507 
Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "request" parameter in admin/fetch_gendercs.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-09T00:00:00.000Z
CVE-2024-31510 
An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithium-standard_ml-dsa-44-ipd_avx2/sign.c component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T14:14:31.086Z
CVE-2024-31525 
Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result, for example, in creating a new admin user in the system which enables persistent access for the attacker as an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-05T00:00:00.000Z
CVE-2024-31544 
A stored cross-site scripting (XSS) vulnerability in Computer Laboratory Management System v1.0 allows attackers to execute arbitrary JavaScript code by including malicious payloads into “remarks”, “borrower_name”, “faculty_department” parameters in /classes/Master.php?f=save_record.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-09T00:00:00.000Z
CVE-2024-31545 
Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manage_user&id=6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-31546 
Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/damage/view_damage.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2024-31547 
Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/item/view_item.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2024-31551 
Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-26T00:00:00.000Z
CVE-2024-31552 
CuteHttpFileServer v.3.1 version has an arbitrary file download vulnerability, which allows attackers to download arbitrary files on the server and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2024-31556 
An issue in Reportico Web before v.8.1.0 allows a local attacker to execute arbitrary code and obtain sensitive information via the sessionid function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T20:15:38.438Z
CVE-2024-31570 
libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-19T00:00:00.000Z
CVE-2024-31573 
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
Problem types: cwe_id: CWE-669
description: CWE-669 Incorrect Resource Transfer Between Spheres
Affected products: vendor: XMLUnit
product: XMLUnit for Java
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Published: 2025-10-17T00:00:00.000Z
CVE-2024-31574 
Cross Site Scripting vulnerability in TWCMS v.2.6 allows a local attacker to execute arbitrary code via a crafted script
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-25T00:00:00.000Z
CVE-2024-31578 
FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-17T00:00:00.000Z
CVE-2024-31580 
PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-17T00:00:00.000Z
CVE-2024-31581 
FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs_h266_syntax_template.c. This vulnerability allows attackers to cause undefined behavior within the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-17T00:00:00.000Z
CVE-2024-31582 
FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-17T00:00:00.000Z
CVE-2024-31583 
Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-17T00:00:00.000Z
CVE-2024-31584 
Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2024-31585 
FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf_showspectrum.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-17T00:00:00.000Z
CVE-2024-31586 
A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0. This vulnerability allows a remote attacker to execute arbitrary code via the Borrower Name, Department, and Remarks parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-20T00:00:00.000Z
CVE-2024-31587 
SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2024-31601 
An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v. 20240323 and before allows attackers to execute arbitrary code via the exportpdf.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-26T00:00:00.000Z
CVE-2024-31609 
Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-25T00:00:00.000Z
CVE-2024-31610 
File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management System v1.0 allows attackers to run arbitrary code via upload of crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-25T00:00:00.000Z
CVE-2024-31611 
SeaCMS 12.9 has a file deletion vulnerability via admin_template.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-10T00:00:00.000Z
CVE-2024-31612 
Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access administrator information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-10T00:00:00.000Z
CVE-2024-31613 
BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-10T00:00:00.000Z
CVE-2024-31615 
ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-25T00:00:00.000Z
CVE-2024-31616 
An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(07150910) allows attackers to execute arbitrary code via the common_quick_config.lua file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-23T00:00:00.000Z
CVE-2024-31617 
OpenLiteSpeed before 1.8.1 mishandles chunked encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-22T17:42:57.754Z
CVE-2024-31621 
An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-29T00:00:00.000Z
CVE-2024-31634 
Cross Site Scripting (XSS) vulnerability in Xunruicms versions 4.6.3 and before, allows remote attacker to execute arbitrary code via the Security.php file in the catalog \XunRuiCMS\dayrui\Fcms\Library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-16T00:00:00.000Z
CVE-2024-31636 
An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-03T00:00:00.000Z
CVE-2024-31648 
Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category Name parameter at /core/new_category2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-15T00:00:00.000Z
CVE-2024-31649 
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-15T00:00:00.000Z
CVE-2024-31650 
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-15T00:00:00.000Z
CVE-2024-31651 
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-15T00:00:00.000Z
CVE-2024-31652 
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-15T00:00:00.000Z
CVE-2024-31666 
An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2024-31668 
rizin before v0.6.3 is vulnerable to Improper Neutralization of Special Elements via meta_set function in librz/analysis/meta.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-17T00:00:00.000Z
CVE-2024-31669 
rizin before Release v0.6.3 is vulnerable to Uncontrolled Resource Consumption via bin_pe_parse_imports, Pe_r_bin_pe_parse_var, and estimate_slide.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-02T00:00:00.000Z
CVE-2024-31670 
rizin before v0.6.3 is vulnerable to Buffer Overflow via create_cache_bins, read_cache_accel, and rz_dyldcache_new_buf functions in librz/bin/format/mach0/dyldcache.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-12T00:00:00.000Z
CVE-2024-31673 
Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in load_data.php via the userid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-03T00:00:00.000Z
CVE-2024-31678 
Sourcecodester Loan Management System v1.0 is vulnerable to SQL Injection via the "password" parameter in the "login.php" file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-11T00:00:00.000Z
CVE-2024-31680 
File Upload vulnerability in Shibang Communications Co., Ltd. IP network intercom broadcasting system v.1.0 allows a local attacker to execute arbitrary code via the my_parser.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-16T00:00:00.000Z
CVE-2024-31682 
Incorrect access control in the fingerprint authentication mechanism of Phone Cleaner: Boost & Clean v2.2.0 allows attackers to bypass fingerprint authentication due to the use of a deprecated API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-03T19:07:26.884Z
CVE-2024-31684 
Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass fingerprint authentication due to the use of a deprecated API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-03T19:05:16.824Z
CVE-2024-31695 
A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authentication when adding a new fingerprint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-14T00:00:00.000Z
CVE-2024-31705 
An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-29T00:00:00.000Z
CVE-2024-31714 
Buffer Overflow vulnerability in Waxlab wax v.0.9-3 and before allows an attacker to cause a denial of service via the Lua library component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-20T17:17:45.261Z
CVE-2024-31741 
Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-26T00:00:00.000Z
CVE-2024-31744 
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-19T00:00:00.000Z
CVE-2024-31747 
An issue in Yealink VP59 Microsoft Teams Phone firmware 91.15.0.118 (fixed in 122.15.0.142) allows a physically proximate attacker to disable the phone lock via the Walkie Talkie menu option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-29T00:00:00.000Z
CVE-2024-31750 
SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-18T00:00:00.000Z
CVE-2024-31755 
cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of function cJSON_SetValuestring at cJSON.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-26T00:00:00.000Z
CVE-2024-31756 
An issue in MarvinTest Solutions Hardware Access Driver v.5.0.3.0 and before and fixed in v.5.0.4.0 allows a local attacker to escalate privileges via the Hw65.sys component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T19:57:26.870Z
CVE-2024-31757 
An issue in TeraByte Unlimited Image for Windows v.3.64.0.0 and before and fixed in v.4.0.0.0 allows a local attacker to escalate privileges via the TBOFLHelper64.sys and TBOFLHelper.sys component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T17:37:47.272Z
CVE-2024-31759 
An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-16T00:00:00.000Z
CVE-2024-31760 
An issue in sanluan flipped-aurora gin-vue-admin 2.4.x allows an attacker to escalate privileges via the Session Expiration component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-16T00:00:00.000Z
CVE-2024-31771 
Insecure Permission vulnerability in TotalAV v.6.0.740 allows a local attacker to escalate privileges via a crafted file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T18:42:47.733Z
CVE-2024-31777 
File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2024-31783 
Cross Site Scripting (XSS) vulnerability in Typora v.1.6.7 and before, allows a local attacker to obtain sensitive information via a crafted script during markdown file creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-16T00:00:00.000Z
CVE-2024-31784 
An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-16T00:00:00.000Z
CVE-2024-31798 
Identical Hardcoded Root Password for All Devices in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to retrieve the root password for all similar devices
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-31799 
Information Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via the UART Debugging Port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-31800 
Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell via the UART Debugging Port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-08-15T00:00:00.000Z
CVE-2024-31801 
Directory Traversal vulnerability in NEXSYS-ONE before v.Rev.15320 allows a remote attacker to obtain sensitive information via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-29T00:00:00.000Z
CVE-2024-31802 
DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-27T00:00:00.000Z
CVE-2024-31803 
Buffer Overflow vulnerability in emp-ot v.0.2.4 allows a remote attacker to execute arbitrary code via the FerretCOT<T>::read_pre_data128_from_file function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-09T13:56:13.026Z
CVE-2024-31804 
An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.exe component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-23T00:00:00.000Z
CVE-2024-31805 
TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-31806 
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which can reboot the system without authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-31807 
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-31808 
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-31809 
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-31810 
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T19:58:17.623Z
CVE-2024-31811 
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in the setLanguageCfg function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z
CVE-2024-31812 
In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-08T00:00:00.000Z