rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-60419 
An issue was discovered in the NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348) allowing local authenticated attackers to send a crafted IOCTL request to the driver to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60424 
A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-27T00:00:00.000Z
CVE-2025-60425 
Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-27T00:00:00.000Z
CVE-2025-60427 
LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls. The backend does not verify role-based permissions for analytics endpoints, allowing unauthorized retrieval of station-wide metrics. This results in information disclosure to less privileged users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-21T00:00:00.000Z
CVE-2025-60445 
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SVG file uploads in the dayrui/Fcms/Library/Upload.php component, allowing attackers to inject malicious JavaScript code that executes when the uploaded file is viewed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-03T00:00:00.000Z
CVE-2025-60447 
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration component located at /admin/setting.php?action=mail, which allows administrators to input HTML code that is not properly sanitized, leading to persistent JavaScript execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-03T00:00:00.000Z
CVE-2025-60448 
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file uploads in the /admin/media.php component, allowing attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-03T00:00:00.000Z
CVE-2025-60449 
An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also potentially any file accessible on the server’s root directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-03T00:00:00.000Z
CVE-2025-60450 
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-03T00:00:00.000Z
CVE-2025-60451 
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\uploadify.class.php component, specifically in the website settings module. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-03T00:00:00.000Z
CVE-2025-60452 
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, specifically in the app\system\download\admin\download_admin.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-03T00:00:00.000Z
CVE-2025-60453 
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, specifically in the app\system\column\admin\index.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-03T00:00:00.000Z
CVE-2025-60454 
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, specifically in the app\system\img\admin\img_admin.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-03T00:00:00.000Z
CVE-2025-60455 
Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-18T00:00:00.000Z
CVE-2025-60458 
UxPlay 1.72 contains a double free vulnerability in its RTSP request handling. A specially crafted RTSP TEARDOWN request can trigger multiple calls to free() on the same memory address, potentially causing a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-12-29T00:00:00.000Z
CVE-2025-60477 
A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2025-60481 
A NULL pointer dereference in the gf_odf_ac4_cfg_dsi_v1 function (/odf/descriptors.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-01T00:00:00.000Z
CVE-2025-60483 
A NULL pointer dereference in the gf_ac4_pres_b_4_back_channels_present function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-01T00:00:00.000Z
CVE-2025-60485 
A segmentation violation in the gf_isom_apple_set_tag_ex function (/isomedia/isom_write.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-01T00:00:00.000Z
CVE-2025-60486 
A heap use-after-free in the dasher_process function (/filters/dasher.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-01T00:00:00.000Z
CVE-2025-60495 
A segmentation violation in the gf_media_get_color_info function (/media_tools/isom_tools.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-01T00:00:00.000Z
CVE-2025-60500 
QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a web-accessible directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-21T00:00:00.000Z
CVE-2025-60503 
A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted in the purchase functionality is reflected without proper escaping in the admin log panel page in the 'reference No.' field. This flaw allows an authenticated attacker to execute arbitrary JavaScript in the context of an administrator's browser session, which could lead to session hijacking or other malicious actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-03T00:00:00.000Z
CVE-2025-60506 
Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-privileged account (e.g., Student) can inject arbitrary JavaScript payloads into a comment. When any other user (Student, Teacher, or Admin) views the annotated PDF, the payload is executed in their browser, leading to session hijacking, credential theft, or other attacker-controlled actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-21T00:00:00.000Z
CVE-2025-60507 
Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users (including Students or Administrators) click the link, the payload executes in their browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:L/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 8.9
baseSeverity: HIGH
Published: 2025-10-21T00:00:00.000Z
CVE-2025-60511 
Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the blockId parameter in /blocks/openai_chat/api/completion.php. An authenticated student can impersonate another user's block (e.g., administrator) and send queries that are executed with that block's configuration. This can expose administrator-only Source of Truth entries, alter model behavior, and potentially misuse API resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-21T00:00:00.000Z
CVE-2025-60514 
Tillywork v0.1.3 and below is vulnerable to SQL Injection in app/common/helpers/query.builder.helper.ts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-17T00:00:00.000Z
CVE-2025-60534 
Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selectively proxy requests in order to operate functionality on the web application without the need to authenticate with legitimate credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-06T00:00:00.000Z
CVE-2025-60535 
A Cross-Site Request Forgery (CSRF) in the component /endpoints/currency/currency of Wallos v4.1.1 allows attackers to execute arbitrary operations via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-14T00:00:00.000Z
CVE-2025-60536 
An issue in the Configure New Cluster interface of kafka-ui v0.6.0 to v0.7.2 allows attackers to cause a Denial of Service (DoS) via uploading a crafted configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-14T00:00:00.000Z
CVE-2025-60537 
Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers to execute arbitrary code via supplying crafted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-14T00:00:00.000Z
CVE-2025-60538 
A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-01-09T00:00:00.000Z
CVE-2025-60540 
karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery (SSRF).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-14T00:00:00.000Z
CVE-2025-60541 
A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-06T00:00:00.000Z
CVE-2025-60542 
SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-29T00:00:00.000Z
CVE-2025-60547 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard7.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60548 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLanSetupRouterSettings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60549 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAutoDetecWAN_wizard4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60550 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formEasySetTimezone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60551 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the next_page parameter in the function formDeviceReboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60552 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formTcpipSetup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60553 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWAN_Wizard52.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60554 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEnableWizard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60555 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizardSelectMode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60556 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetWizard1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60557 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEasy_Wizard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60558 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formVirtualServ.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60559 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetDomainFilter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60561 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetEmail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60562 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formWlSiteSurvey.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60563 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetPortTr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60564 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetLog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60565 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSchedule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60566 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetMACFilter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60568 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvFirewall.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60569 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetRoute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60570 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formLogDnsquery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60571 
D-Link DIR600LAx FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formSetQoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60572 
D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter in the function formAdvNetwork.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-24T00:00:00.000Z
CVE-2025-60574 
A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the "/styles/" path, which fails to properly sanitize user-supplied input. An attacker can exploit this by sending a crafted GET request to retrieve arbitrary files from the underlying system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-07T00:00:00.000Z
CVE-2025-60595 
SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-29T00:00:00.000Z
CVE-2025-60632 
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-24T00:00:00.000Z
CVE-2025-60633 
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-24T00:00:00.000Z
CVE-2025-60638 
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-24T00:00:00.000Z
CVE-2025-60639 
Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c (2025-05-26).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-16T00:00:00.000Z
CVE-2025-60641 
The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserialize(base64_decode($_POST['mexcel'])), where $_POST['mexcel'] is user-controlled input. This input is decoded from base64 and deserialized without validation or use of the allowed_classes option, allowing an attacker to inject arbitrary PHP objects. This can lead to malicious behavior, such as Remote Code Execution (RCE), SQL Injection, Path Traversal, or Denial of Service, depending on the availability of exploitable classes in the Vfront codebase or its dependencies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-16T00:00:00.000Z
CVE-2025-60645 
A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-12T00:00:00.000Z
CVE-2025-60646 
A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-11-12T00:00:00.000Z
CVE-2025-60660 
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the mac parameter in the fromAdvSetMacMtuWan function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-02T00:00:00.000Z
CVE-2025-60661 
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuWan function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-02T00:00:00.000Z
CVE-2025-60662 
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanSpeed parameter in the fromAdvSetMacMtuWan function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-10-02T00:00:00.000Z