rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-36603 
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36604 
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker can rebind a domain to the router's internal IP address, extending the CORS wildcard vulnerability (Access-Control-Allow-Origin: *) to internet-originated attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36605 
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low number of crafted incomplete HTTP requests, causing a persistent crash that requires physical power cycling to recover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36606 
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36607 
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36608 
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192.168.1.1) or localhost (127.0.0.1) as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the internet with a single SOAP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36609 
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows an attacker to reverse captured authentication tokens to recover the plaintext password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36610 
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. The firmware contains no TLS implementation, allowing man-in-the-middle interception of DDNS service credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36611 
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36612 
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36613 
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POST requests to undefined paths, exposing server state to unauthenticated adjacent network attackers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36615 
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer contents to unauthenticated attackers on the adjacent network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36616 
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default PSK embedded in the production firmware binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36618 
Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software version (unbound 1.22.0), aiding targeted attacks against known vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36734 
EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. An authenticated attacker with access to the network can submit crafted input to the WLAN configuration functionality. Due to insufficient input validation, the attacker is able to execute arbitrary system commands on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-11T00:00:00.000Z
CVE-2026-36738 
U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Incorrect Access Control. The device exposes a UART interface that lacks authentication, authorization, or access control mechanisms. An attacker with physical access to the UART pins can connect to the interface and gain unrestricted access to device functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-13T00:00:00.000Z
CVE-2026-36741 
U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection. The Network Time Protocol (NTP) configuration interface does not properly sanitize user-supplied input. An authenticated user with permission to configure NTP settings can inject arbitrary system commands through crafted input fields. These commands are executed with elevated privileges, leading to potential full system compromise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-13T00:00:00.000Z
CVE-2026-36742 
Hiseeu C90 v5.7.15 is vulnerable to Insecure Permissions. The UART bootloader is accessible when battery is disconnected (hidden/debug mode).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-13T00:00:00.000Z
CVE-2026-36748 
RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-36756 
A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36757 
A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36758 
A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36759 
A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36760 
An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations while chunked upload is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36761 
A stored cross-site scripting (XSS) vulnerability in the /msg/msgInner/save endpoint of JeeSite v5.15.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted input into the msgContent parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36762 
An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36763 
A stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted input into the content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36764 
A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers to scan internal resources via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36765 
An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36766 
Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream() or getReader() functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36767 
A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36785 
Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the page parameter of the fromDhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-05T00:00:00.000Z
CVE-2026-36786 
Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the list1 parameter of the fromDhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-08T00:00:00.000Z
CVE-2026-36789 
Shenzhen Tenda Technology Co., Ltd Tenda AC1206 v15.03.06.23 was discovered to contain multiple stack overflows in the fromGstDhcpSetSer function via the username and password parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-08T00:00:00.000Z
CVE-2026-36827 
A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-19T00:00:00.000Z
CVE-2026-36828 
A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7. The CGI component allows authenticated users to execute arbitrary shell commands with root privileges via the action=runcmd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-19T00:00:00.000Z
CVE-2026-36829 
An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. The server validates session cookies using a filesystem existence check based on a user-controlled cookie value without proper sanitization, allowing directory traversal and bypass of authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-19T00:00:00.000Z
CVE-2026-36837 
TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the hostname parameter in the formMapDelDevice function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-29T00:00:00.000Z
CVE-2026-36841 
TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-29T00:00:00.000Z
CVE-2026-36872 
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_book.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36873 
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36874 
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_student.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36906 
Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log Record Function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-11T00:00:00.000Z
CVE-2026-36919 
Sourcecodester Online Reviewer System v1.0 is vulnerale to SQL Injection in the file /system/system/admins/assessments/examproper/exam-update.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36920 
Sourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questions-view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36922 
Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection in the file /cms/admin/categories/view_category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36923 
Sourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the file /cms/admin/bookings/view_booking.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36937 
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36938 
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36941 
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in the file /orms/admin/rooms/manage_room.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36942 
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36943 
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_repair.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36944 
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36945 
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_client.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36946 
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_details.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36947 
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL Injection in the file /rsms/admin/services/view_service.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36948 
Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36950 
Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36952 
Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage_curriculum.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-36956 
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints such as /api/setWlan. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36957 
Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handler. By initiating a high-volume flood of HTTP GET requests to non-existent URIs, an attacker can exhaust critical system resources, including file descriptors and memory buffers. This results in a kernel deadlock or system hang that disables the web management portal and all routing capabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36958 
A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router. By sending a large number of concurrent HTTP requests to random or non-existent endpoints on the web management interface, an attacker can exhaust system resources in the embedded Boa HTTP server. This causes the router web interface to become unresponsive and may require manual reboot to restore normal operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36959 
U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This allows an attacker on the local network to perform unlimited authentication attempts, enabling brute-force attacks against the administrator account and potential unauthorized access to the router management interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36960 
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-36962 
SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, and potentially gain remote code execution by writing malicious files to the server's file system via the keyword parameter in the /index/controller/Search.php endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-11T00:00:00.000Z
CVE-2026-36983 
D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd. The manipulation of the argument LightSensorControl leads to command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-11T00:00:00.000Z
CVE-2026-37100 
An issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar firmware 2.40 (Mobile App: Sound Bar Remote / version: 2.40) allows remote attackers within BLE radio range to connect without authentication via the Sound Bar Remote protocol
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-16T00:00:00.000Z