rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-5648 code-projects Simple Laundry System Parameter userfinishregister.php sql injection
A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.php of the component Parameter Handler. This manipulation of the argument firstName causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Simple Laundry System
cpes: cpe:2.3:a:code-projects:simple_laundry_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: yao23333 (VulDB User)
Published: 2026-04-06T11:00:14.213Z
CVE-2026-5649 code-projects Online Application System for Admission Endpoint admsnform.php sql injection
A vulnerability has been found in code-projects Online Application System for Admission 1.0. This issue affects some unknown processing of the file /enrollment/admsnform.php of the component Endpoint. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Online Application System for Admission
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: AhmadMarzouk (VulDB User)
Published: 2026-04-06T11:15:10.548Z
CVE-2026-5650 code-projects Online Application System for Admission oas.sql sensitive information
A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-922
description: Insecure Storage of Sensitive Information
cwe_id: CWE-200
description: Information Disclosure
Affected products: vendor: code-projects
product: Online Application System for Admission
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: AhmadMarzouk (VulDB User)
Published: 2026-04-06T11:30:13.217Z
CVE-2026-5652 Authorization Bypass Through User-Controlled Key in Crafty Controller
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permissions validation.
Problem types: cwe_id: CWE-639
description: CWE-639: Authorization Bypass Through User-Controlled Key
Affected products: vendor: Arcadia Technology, LLC
product: Crafty Controller
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 9
baseSeverity: CRITICAL
Credits: lang: en
value: Thank you to [Kacper Leszczyński / szotgan](https://gitlab.com/szotgan) on GitLab for reporting this issue.
Published: 2026-04-21T16:33:56.878Z
CVE-2026-5653 Heap-based Buffer Overflow in Wireshark
DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Alexandre de Oliveira
Published: 2026-04-30T05:38:49.245Z
CVE-2026-5654 Stack-based Buffer Overflow in Wireshark
AMR-NB codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Alexandre de Oliveira
Published: 2026-04-30T05:39:04.227Z
CVE-2026-5655 Use After Free in Wireshark
SDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 allows denial of service
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Huang Qiangxiong
Published: 2026-04-30T05:38:59.211Z
CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark
Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
Credits: lang: en
value: TODO
Published: 2026-04-30T23:03:58.516Z
CVE-2026-5657 Double Free in Wireshark
iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Problem types: cwe_id: CWE-415
description: CWE-415: Double Free
Affected products: vendor: Wireshark Foundation
product: Wireshark
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
Credits: lang: en
value: Alexandre de Oliveira
Published: 2026-04-30T05:38:54.201Z
CVE-2026-5659 pytries datrie trie File datrie.pyx Trie.__setstate__ deserialization
A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.__setstate__ of the file src/datrie.pyx of the component trie File Handler. The manipulation results in deserialization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-502
description: Deserialization
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: pytries
product: datrie
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: dhabaleshwar (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-06T13:00:19.796Z
CVE-2026-5660 itsourcecode Construction Management System Parameter borrowed_equip.php sql injection
A vulnerability was determined in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /borrowed_equip.php of the component Parameter Handler. This manipulation of the argument emp causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Construction Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Yeliuyun (VulDB User)
Published: 2026-04-06T13:45:10.471Z
CVE-2026-5661 Free5GC NGSetupRequest denial of service
A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit is publicly available and might be used.
Problem types: cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: Free5GC
cpes: cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: shovon0203 (VulDB User)
Published: 2026-04-06T14:08:19.647Z
CVE-2026-5663 OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection
A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: OFFIS
product: DCMTK
cpes: cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
baseSeverity: HIGH
Credits: lang: en
value: Simon Weber (Machine Spirits)
lang: en
value: Volker Schönefeld (Machine Spirits)
lang: en
value: simon4machinespirits (VulDB User)
Published: 2026-04-06T14:15:11.214Z
CVE-2026-5665 code-projects Online FIR System Login checklogin.php sql injection
A security vulnerability has been detected in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/checklogin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Online FIR System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: AhmadMarzouk (VulDB User)
Published: 2026-04-06T15:15:12.944Z
CVE-2026-5666 code-projects Online FIR System SQL Database Backup File complaints.sql sensitive information
A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the component SQL Database Backup File Handler. The manipulation results in insecure storage of sensitive information. The attack may be performed from remote. The exploit is now public and may be used.
Problem types: cwe_id: CWE-922
description: Insecure Storage of Sensitive Information
cwe_id: CWE-200
description: Information Disclosure
Affected products: vendor: code-projects
product: Online FIR System
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: AhmadMarzouk (VulDB User)
Published: 2026-04-06T15:30:13.502Z
CVE-2026-5668 Cyber-III Student-Management-System add%20notice.php cross site scripting
A flaw has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown part of the file /admin/Add%20notice/add%20notice.php. This manipulation of the argument $_SERVER['PHP_SELF'] causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: Cyber-III
product: Student-Management-System
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: saberhcx (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-06T16:15:13.743Z
CVE-2026-5669 Cyber-III Student-Management-System Parameter login.php sql injection
A vulnerability has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This vulnerability affects unknown code of the file /login.php of the component Parameter Handler. Such manipulation of the argument Password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: Cyber-III
product: Student-Management-System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: ChenFu (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-06T16:30:12.215Z
CVE-2026-5670 Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload
A vulnerability was found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This issue affects the function move_uploaded_file of the file /AssignmentSection/submission/upload.php. Performing a manipulation of the argument File results in unrestricted upload. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-434
description: Unrestricted Upload
cwe_id: CWE-284
description: Improper Access Controls
Affected products: vendor: Cyber-III
product: Student-Management-System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Lier (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-06T16:45:11.611Z
CVE-2026-5671 Cyber-III Student-Management-System Class Schedule Deletion Endpoint delete_batch.php cross site scripting
A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Impacted is an unknown function of the file /admin/class%20schedule/delete_batch.php of the component Class Schedule Deletion Endpoint. Executing a manipulation of the argument batch can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: Cyber-III
product: Student-Management-System
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: zsmaaa (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-04-06T17:15:11.400Z
CVE-2026-5672 code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection
A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category.php of the component Parameter Handler. The manipulation of the argument cat_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Simple IT Discussion Forum
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Czhan (VulDB User)
Published: 2026-04-06T17:45:10.127Z
CVE-2026-5673 Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing
A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.
Problem types: cwe_id: CWE-125
description: Out-of-bounds Read
Affected products: vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank ChenZhengzhe (HangZhouDianZi University) for reporting this issue.
Published: 2026-04-06T09:22:36.227Z
CVE-2026-5675 itsourcecode Construction Management System Parameter borrowed_tool.php sql injection
A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of the component Parameter Handler. The manipulation of the argument emp results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Construction Management System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: 3025680542 (VulDB User)
Published: 2026-04-06T18:00:16.247Z
CVE-2026-5676 Totolink A8000R cstecgi.cgi setLanguageCfg missing authentication
A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument langType leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used.
Problem types: cwe_id: CWE-306
description: Missing Authentication
cwe_id: CWE-287
description: Improper Authentication
Affected products: vendor: Totolink
product: A8000R
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R
baseSeverity: HIGH
Credits: lang: en
value: skeet (VulDB User)
Published: 2026-04-06T18:15:12.227Z
CVE-2026-5677 Totolink A7100RU cstecgi.cgi CsteSystem os command injection
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument resetFlags results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Totolink
product: A7100RU
cpes: cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: LtzHuster2 (VulDB User)
Published: 2026-04-06T18:30:13.417Z
CVE-2026-5678 Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument mode can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Totolink
product: A7100RU
cpes: cpe:2.3:o:totolink:a7100ru_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: LtzHuster2 (VulDB User)
Published: 2026-04-06T18:45:11.415Z
CVE-2026-5679 Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection
A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_B20221024. The impacted element is the function vsetTr069Cfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument stun_pass leads to os command injection. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: Totolink
product: A3300R
cpes: cpe:2.3:o:totolink:a3300r_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: m202572177 (VulDB User)
Published: 2026-04-06T19:00:19.633Z