rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-44137 
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET parameters are "TileMatrix", "TileRow", "TileCol" and "Format"
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-29T00:00:00.000Z
CVE-2025-44139 
Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-01T00:00:00.000Z
CVE-2025-44141 
A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-26T00:00:00.000Z
CVE-2025-44148 
Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-03T00:00:00.000Z
CVE-2025-44163 
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-27T00:00:00.000Z
CVE-2025-44172 
Tenda AC6 V15.03.05.16 was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-02T00:00:00.000Z
CVE-2025-44175 
Tenda AC10 v4 V16.03.10.13 is vulnerable to Buffer Overflow in the GetParentControlInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-12T00:00:00.000Z
CVE-2025-44176 
Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-12T00:00:00.000Z
CVE-2025-44177 
A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenticated attacker can remotely read arbitrary files on the underlying OS using encoded traversal sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-09T00:00:00.000Z
CVE-2025-44178 
DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings. Attackers can exploit this vulnerability to gain unauthorized access to sensitive information and modify its configuration via the UPnP protocol WAN sides without any authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-44179 
Hitron CGNF-TWN 3.1.1.43-TWN-pre3 contains a command injection vulnerability in the telnet service. The issue arises due to improper input validation within the telnet command handling mechanism. An attacker can exploit this vulnerability by injecting arbitrary commands through the telnet interface when prompted for inputs or commands. Successful exploitation could lead to remote code execution (RCE) under the privileges of the telnet user, potentially allowing unauthorized access to system settings and sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-25T00:00:00.000Z
CVE-2025-44180 
Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit-brand.php?bid={brandId}.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2025-44181 
Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/add-brand.php via the brandname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2025-44182 
Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum, enginenumber' in the /admin/edit-vehicle.php component. This allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2025-44183 
Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the name, email, and mobile parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2025-44184 
SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the website_image, fname, lname, contact, username, and address parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-14T00:00:00.000Z
CVE-2025-44185 
SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/change_pass.php via the password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2025-44186 
SourceCodester Best Employee Management System 1.0 is vulnerable to Cross Site Request Forgery (CSRF) in /admin/Operation/User.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-14T00:00:00.000Z
CVE-2025-44192 
SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_clearance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-30T00:00:00.000Z
CVE-2025-44193 
SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_complaint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-30T00:00:00.000Z
CVE-2025-44194 
SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_household.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-04-30T00:00:00.000Z
CVE-2025-44203 
In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, the attack results in a Denial of Service (DoS), preventing the administrator from logging in even with the correct credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-20T00:00:00.000Z
CVE-2025-44206 
Hexagon HxGN OnCall Dispatch Advantage (Web) v10.2309.03.00264 and Hexagon HxGN OnCall Dispatch Advantage (Mobile) v10.2402 are vulnerable to Cross Site Scripting (XSS) which allows a remote authenticated attacker with access to the Broadcast (Person) functionality to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:U/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
Published: 2025-06-25T00:00:00.000Z
CVE-2025-44251 
Ecovacs Deebot T10 1.7.2 transmits Wi-Fi credentials in cleartext during the pairing process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-10T00:00:00.000Z
CVE-2025-44525 
Texas Instruments CC2652RB LaunchPad SimpleLink CC13XX CC26XX SDK 7.41.00.17 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data packets. This issue allows attackers to cause a Denial of Service (DoS) via a crafted LL_Length_Req packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-09T00:00:00.000Z
CVE-2025-44526 
Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data packets. This issue allows attackers to cause a Denial of Service (DoS) via a crafted LL_Length_Req packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-09T00:00:00.000Z
CVE-2025-44528 
An issue in Texas Instruments LP-CC2652RB SimpleLink CC13XX CC26XX SDK 7.41.00.17 allows attackers to cause a Denial of Service (DoS) via sending a crafted LL_Pause_Enc_Req packet during the authentication and connection phase, causing a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-23T00:00:00.000Z
CVE-2025-44531 
An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pairing public key is received during a Bluetooth connection attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-24T00:00:00.000Z
CVE-2025-44557 
A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing process and authentication via a crafted pairing_failed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-27T00:00:00.000Z
CVE-2025-44559 
An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denial of Service (DoS) via sending a specific sequence of crafted control packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-27T00:00:00.000Z
CVE-2025-44560 
owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-10T00:00:00.000Z
CVE-2025-44593 
Halo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as .exe and .html files. Specifically, .html files can trigger stored XSS vulnerabilities. This vulnerability is fixed in 2.20.13
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-09T00:00:00.000Z
CVE-2025-44594 
halo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api.storage.halo.run/v1alpha1/attachments/-/upload-from-url.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-09T00:00:00.000Z
CVE-2025-44595 
Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-09T00:00:00.000Z
CVE-2025-44608 
CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-25T00:00:00.000Z
CVE-2025-44612 
Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing attackers to possibly intercept and access sensitive information via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-30T00:00:00.000Z
CVE-2025-44614 
Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-30T00:00:00.000Z
CVE-2025-44619 
Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the network without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-30T00:00:00.000Z
CVE-2025-44635 
There are multiple unauthorized remote command execution vulnerabilities in the H3C ER2200G2, ERG2-450W, ERG2-1200W, ERG2-1350W, NR1200W series routers before ERG2AW-MNW100-R1117; H3C ER3100G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2, ER6300G2, ER8300G2, ER8300G2-X series routers before ERHMG2-MNW100-R1126; GR3200, GR5200, GR8300 and other series routers before MiniGR1B0V100R018L50; GR-1800AX before MiniGRW1B0V100R009L50; GR-3000AX before SWBRW1A0V100R007L50; and GR-5400AX before SWBRW1B0V100R009L50. Attackers can bypass authentication by including specially crafted text in the request URL or message header, and then inject arbitrary malicious commands into some fields related to ACL access control list and user group functions and execute to obtain the highest ROOT privileges of remote devices, thereby completely taking over the remote target devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-20T00:00:00.000Z
CVE-2025-44643 
Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-04T00:00:00.000Z
CVE-2025-44647 
In TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk option is enabled in the strongSwan configuration file, so that IKE Responders are allowed to use IKEv1 Aggressive Mode with Pre-Shared Keys to conduct offline attacks on the openly transmitted hash of the PSK.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-44649 
In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive mode in IKE Phase 1 exposes identity information in plaintext, is vulnerable to offline dictionary attacks, and lacks flexibility in negotiating security parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-44650 
In Netgear R7000 V1.3.1.64_10.1.36 and EAX80 V1.0.1.70_1.0.2, the USERLIMIT_GLOBAL option is set to 0 in the bftpd.conf configuration file. This can cause DoS attacks when unlimited users are connected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-44651 
In TRENDnet TPL-430AP FW1.0, the USERLIMIT_GLOBAL option is set to 0 in the bftpd-related configuration file. This can cause DoS attacks when unlimited users are connected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-44652 
In Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attacks when unlimited users are connected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-44653 
In H3C GR2200 MiniGR1A0V100R016, the USERLIMIT_GLOBAL option is set to 0 in the /etc/bftpd.conf. This can cause DoS attacks when unlimited users are connected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-44654 
In Linksys E2500 3.0.04.002, the chroot_local_user option is enabled in the vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-44655 
In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-44657 
In Linksys EA6350 V2.1.2, the chroot_local_user option is enabled in the dynamically generated vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-44658 
In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them as PHP, bypassing security mechanisms based on file extension filtering. This may lead to remote code execution (RCE), information disclosure, or full system compromise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-07-21T00:00:00.000Z
CVE-2025-44779 
An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-08-07T00:00:00.000Z
CVE-2025-44823 
Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: Nagios
product: Log Server
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 9.9
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: 2025-10-07T00:00:00.000Z
CVE-2025-44824 
Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response. This is GL:NLS#474.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Nagios
product: Log Server
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Published: 2025-10-07T00:00:00.000Z
CVE-2025-44830 
EngineerCMS v1.02 through v.2.0.5 has a SQL injection vulnerability in the /project/addprojtemplet interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-12T00:00:00.000Z
CVE-2025-44831 
EngineerCMS v1.02 through v2.0.5 has a SQL injection vulnerability in the /project/addproject interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-13T00:00:00.000Z
CVE-2025-44835 
D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in iptablesWebsFilterRun, which allows remote attackers to execute arbitrary commands via shell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z
CVE-2025-44836 
TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z
CVE-2025-44837 
TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or magicid parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z
CVE-2025-44838 
TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z
CVE-2025-44839 
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z
CVE-2025-44840 
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z
CVE-2025-44841 
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z
CVE-2025-44842 
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z
CVE-2025-44843 
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z
CVE-2025-44844 
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z
CVE-2025-44845 
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-01T00:00:00.000Z