---METADATA---
VENDOR: Tenda
PRODUCT: F453
AFFECTED_VERSIONS: 1.0.0.3, 3.As
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349707","name":"VDB-349707 | Tenda F453 PPTPDClient fromPptpUserAdd stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349707","name":"VDB-349707 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.766934","name":"Submit #766934 | Tenda F453 v1.0.0.3 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/F453/vul_98/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.798Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow vulnerability exists in the Tenda F453 router, specifically within the fromPptpUserAdd function, allowing remote attackers to trigger memory corruption.

Executive Summary:
A stack-based buffer overflow vulnerability in the Tenda F453 router enables remote attackers to achieve arbitrary code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-3729

Affected Software: Tenda F453

Affected Versions: 1.0.0.3, 3.As

Vulnerability: The flaw occurs in the fromPptpUserAdd function within the /goform/PPTPDClient endpoint, where user-supplied username and opttype parameters are processed without sufficient length validation. This allows an authenticated attacker to trigger a stack-based buffer overflow via a specially crafted HTTP POST request.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network integrity and availability. An attacker could gain unauthorized remote code execution capabilities on the affected device, potentially leading to full system compromise or a persistent denial of service that disrupts critical connectivity. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized access to the network infrastructure.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, users should restrict administrative access to the management interface and verify if the vendor has released a firmware update via the official Tenda support website.

Proactive Monitoring: Security teams should monitor network traffic for anomalous HTTP POST requests directed toward the /goform/PPTPDClient endpoint and review device logs for signs of repeated crashes or unauthorized configuration changes.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to block unauthorized access to the router management interface, effectively isolating the vulnerable function from external reach.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the technical write-up published on the Litengzheng GitHub repository.

Analyst Notes: As of March 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking in the sprintf function when processing user-supplied input.

Analyst Recommendation

The presence of a public proof-of-concept significantly elevates the risk of exploitation for this high-severity vulnerability. Administrators must prioritize isolating the vulnerable Tenda F453 devices from the public internet and apply any available firmware updates from the vendor as soon as they are made available to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Tenda
PRODUCT: F453
AFFECTED_VERSIONS: 1.0.0.3, 1.If
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349706","name":"VDB-349706 | Tenda F453 setcfm fromSetCfm stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349706","name":"VDB-349706 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.766933","name":"Submit #766933 | Tenda F453 v1.0.0.3 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/F453/vul_97/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.798Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F453 router allows remote attackers to trigger denial of service or remote code execution by sending a crafted request to the /goform/setcfm endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda F453 router, specifically within the fromSetCfm function, poses a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-3728

Affected Software: Tenda F453

Affected Versions: 1.0.0.3, 1.If

Vulnerability: The device suffers from a memory corruption flaw due to a stack-based buffer overflow in the /goform/setcfm endpoint. By supplying an excessively long input to the funcpara1 parameter, an attacker can trigger the overflow, which requires the attacker to have at least low-level authenticated access to the management interface.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated or low-privileged remote attacker to achieve arbitrary code execution on the router or cause a complete system crash. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full network compromise, interception of traffic, or persistent backdoors within the organization's perimeter infrastructure.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the management interface of the Tenda F453 to trusted management subnets only.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/setcfm endpoint and check system logs for repeated service crashes or unexpected reboots.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block excessively long payloads sent to the funcpara1 parameter of the setcfm form.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the researcher's technical write-up on GitHub.

Analyst Notes: As of March 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on user-supplied input before passing it to the sprintf function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant threat to internal network security. Network administrators must immediately isolate affected hardware from external access and prioritize the deployment of vendor firmware updates as soon as they become available to mitigate the risk of full device takeover.

---METADATA---
VENDOR: Fire-Boltt
PRODUCT: Smartwatch FB BGS001
AFFECTED_VERSIONS: Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Fire-Boltt Smartwatch FB BGS001 firmware allows unauthorized access via GATT Write Request commands, enabling replay attacks using captured BLE packets.

Executive Summary:
A critical authentication bypass vulnerability in Fire-Boltt Smartwatch FB BGS001 firmware allows attackers to execute arbitrary commands via BLE replay attacks.

Vulnerability Details

CVE-ID: CVE-2026-37271

Affected Software: Fire-Boltt Smartwatch FB BGS001

Affected Versions: Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4

Vulnerability: The device suffers from improper authentication, failing to validate sessions for GATT Write Request commands. An unauthenticated attacker in physical proximity can capture and replay Bluetooth Low Energy (BLE) packets to trigger device functions.

Business Impact

This vulnerability poses a significant risk to user privacy and device integrity. With a CVSS score of 9.8, the potential for total system compromise is high, as an attacker could manipulate smartwatch functions without user consent. Such unauthorized access could lead to the exposure of sensitive personal data or the disruption of critical device services.

Remediation Plan

Immediate Action: Review the vendor advisory at https://github.com/advisories/GHSA-wjqj-v3q8-x4h3 and apply firmware updates if available.

Proactive Monitoring: Monitor the environment for unusual Bluetooth pairing requests or unexpected device behavior that may indicate unauthorized BLE interaction.

Compensating Controls: Disable Bluetooth connectivity on the device when not in use and avoid pairing in public, high-traffic areas where BLE sniffing could occur.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this authentication bypass, administrators and users must prioritize the application of security patches. If a firmware update is not currently available, maintain strict physical control over the device and limit exposure to unauthorized Bluetooth environments.

---METADATA---
VENDOR: Tenda
PRODUCT: F453
AFFECTED_VERSIONS: 1.0.0.3
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349705","name":"VDB-349705 | Tenda F453 QuickIndex sub_3C6C0 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349705","name":"VDB-349705 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.766932","name":"Submit #766932 | Tenda F453 v1.0.0.3 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/F453/vul_96/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.798Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F453 QuickIndex function allows for remote code execution or denial of service via manipulation of the PPPOEPassword argument.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F453 routers allows authenticated attackers to execute arbitrary code or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2026-3727

Affected Software: Tenda F453

Affected Versions: 1.0.0.3

Vulnerability: This vulnerability resides in the sub_3C6C0 function within the /goform/QuickIndex endpoint. It occurs when the application fails to perform length checks on the PPPOEPassword argument during specific configuration requests, allowing an authenticated user to overwrite the stack memory.

Business Impact

Successful exploitation of this flaw can lead to a complete compromise of the affected router, granting an attacker the ability to execute remote code with high privileges. This could result in unauthorized network access, data interception, or persistent system downtime, significantly impacting the availability and integrity of the local network infrastructure. The CVSS score of 8.8 reflects the high severity of this remote execution capability.

Remediation Plan

Immediate Action: Since a specific patch version is not currently listed, administrators should restrict management interface access to trusted IP addresses only and monitor for vendor firmware releases.

Proactive Monitoring: Security teams should monitor network traffic for anomalous POST requests directed at the /goform/QuickIndex endpoint, particularly those containing excessively long strings in the PPPOEPassword field.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP traffic containing oversized payloads targeting the vulnerable form parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up hosted on GitHub by the vulnerability researcher.

Analyst Notes: As of March 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the password parameter, which facilitates straightforward memory corruption.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant risk to network security. Organizations utilizing Tenda F453 devices should prioritize isolating these units from the public internet and verify firmware status with the vendor immediately. Applying future manufacturer security updates as soon as they become available is essential to remediate this flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F453
AFFECTED_VERSIONS: 1.0.0.3
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349704","name":"VDB-349704 | Tenda F453 webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349704","name":"VDB-349704 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.766931","name":"Submit #766931 | Tenda F453 v1.0.0.3 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/F453/vul_85/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.802Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F453 web interface allows remote attackers to trigger denial of service or arbitrary code execution via the page parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F453 routers allows remote attackers to execute arbitrary code or crash the device.

Vulnerability Details

CVE-ID: CVE-2026-3726

Affected Software: Tenda F453

Affected Versions: 1.0.0.3

Vulnerability: The device is susceptible to a stack-based buffer overflow in the web management interface, specifically within the fromwebExcptypemanFilter function. By sending a specially crafted HTTP POST request to the /goform/webExcptypemanFilter endpoint, an authenticated attacker can overflow the stack buffer due to a lack of length validation on the page parameter.

Business Impact

Successful exploitation of this vulnerability can result in full device compromise, allowing an attacker to execute arbitrary code with elevated privileges. Given the CVSS score of 8.8, this poses a significant risk to network integrity, potentially enabling unauthorized access to internal traffic, data interception, or the permanent disruption of network services.

Remediation Plan

Immediate Action: As no official patch is currently confirmed for this specific version, users should restrict access to the device management interface to trusted IP addresses only and disable remote administration features.

Proactive Monitoring: Monitor device logs for unusual HTTP POST requests directed at the /goform/webExcptypemanFilter endpoint and observe for unexpected device reboots or performance degradation.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system to inspect incoming traffic and block requests containing abnormally long strings in the page parameter.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the researcher's public GitHub repository documenting the vulnerability.

Analyst Notes: As of March 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the absence of bounds checking on user-supplied input in the affected function.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the high severity of the potential impact, organizations utilizing Tenda F453 routers must take immediate steps to isolate these devices from external networks. Administrators should prioritize disabling remote management interfaces and closely monitor for unauthorized access attempts until a vendor-supplied firmware update is verified and applied.

---METADATA---
VENDOR: OpenAirInterface
PRODUCT: OpenAirInterface5G (nr-softmodem)
AFFECTED_VERSIONS: 2.4.0
---END_METADATA---

Description Summary:
A divide-by-zero vulnerability in the O-RAN RAN function module of OpenAirInterface5G can lead to application crashes.

Executive Summary:
A critical logic flaw in the OpenAirInterface5G nr-softmodem could cause service outages by triggering an unhandled exception during PRB usage calculations.

Vulnerability Details

CVE-ID: CVE-2026-37232

Affected Software: OpenAirInterface OpenAirInterface5G

Affected Versions: 2.4.0 (nr-softmodem)

Vulnerability: The vulnerability exists in the fill_RRU_PrbTotDl() and fill_RRU_PrbTotUl() functions, where the software performs a division operation without validating the divisor. An unauthenticated remote attacker can trigger this condition, causing the service to crash and resulting in a denial-of-service.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a high risk to telecommunications infrastructure availability. A crash in the nr-softmodem component can disrupt 5G connectivity for connected users, leading to service degradation and potential operational losses for operators relying on this software.

Remediation Plan

Immediate Action: Update the OpenAirInterface5G deployment to a patched version that implements proper zero-check validation in the affected functions.

Proactive Monitoring: Monitor the nr-softmodem service logs for frequent restarts or crash reports that may indicate exploitation attempts.

Compensating Controls: Deploy rate-limiting at the network edge to mitigate potential floods of traffic that might trigger the vulnerable calculation routines.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ease of triggering a crash makes the potential for exploitation high.

Analyst Recommendation

Organizations utilizing OpenAirInterface5G for 5G research or deployment should prioritize patching the nr-softmodem component. Ensuring the stability of these core functions is essential to maintaining network uptime and preventing unauthorized service interruption.

---METADATA---
VENDOR: code-projects
PRODUCT: Simple Flight Ticket Booking System
AFFECTED_VERSIONS: Version 1
---END_METADATA---

Description Summary:
Another security flaw has been discovered in version 1 of the code-projects Simple Flight Ticket Booking System, affecting its overall security.

Executive Summary:
The Simple Flight Ticket Booking System version 1 contains an additional high-severity vulnerability that further increases the risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-3723

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: Version 1

Vulnerability: This is yet another security flaw identified in version 1 of the Simple Flight Ticket Booking System. The vulnerability likely pertains to session management or insecure data storage, which could be exploited by an attacker to gain persistent access to the system.

Business Impact

The CVSS score of 7.3 confirms the High severity of this flaw. If exploited alongside other vulnerabilities in this product, an attacker could achieve complete control over the application, leading to massive data exfiltration and the total disruption of booking services.

Remediation Plan

Immediate Action: Apply all available security updates for the Simple Flight Ticket Booking System version 1 immediately.

Proactive Monitoring: Implement comprehensive logging for all administrative actions and monitor for any unauthorized changes to the application's source code or configuration files.

Compensating Controls: Deploy the application within a containerized environment to limit the impact of a potential compromise and use a WAF to block known exploit payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. The clustering of several CVEs for this product highlights a critical need for immediate remediation.

Analyst Recommendation

The cumulative risk of multiple high-severity vulnerabilities in a single product version is extreme. Administrators must apply all relevant patches immediately or consider transitioning to a more robust and frequently audited booking solution to ensure data security.

---METADATA---
VENDOR: Open5GS
PRODUCT: Open5GS
AFFECTED_VERSIONS: v2.7.6
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/open5gs/open5gs/issues/4277","name":null,"tags":[]},{"url":"https://github.com/open5gs/open5gs/issues/4278","name":null,"tags":[]},{"url":"https://github.com/hackeryounow/5GCVulDB/tree/main/CVE-2026-37198","name":null,"tags":[]},{"url":"https://gist.github.com/hackeryounow/b1b6475d9c1d9b2bd1f1ef895d1f298c","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An integer overflow vulnerability in the SMF component of Open5GS v2.7.6 allows unauthenticated remote attackers to cause a Denial of Service via a crafted GTP packet.

Executive Summary:
A critical integer overflow vulnerability in Open5GS allows unauthenticated remote attackers to crash the Session Management Function, resulting in a total Denial of Service.

Vulnerability Details

CVE-ID: CVE-2026-37198

Affected Software: Open5GS

Affected Versions: v2.7.6

Vulnerability: The vulnerability is an integer overflow located within the SMF component of the Open5GS core network software. It can be triggered by an unauthenticated remote attacker who sends a specially crafted GTP packet to the target system.

Business Impact

The successful exploitation of this flaw results in a complete Denial of Service for the affected session management functions. Given the CVSS score of 7.5, this high severity vulnerability poses a significant risk to network availability, which could lead to widespread service disruption, loss of connectivity for downstream users, and potential operational downtime for telecommunications or private 5G infrastructure.

Remediation Plan

Immediate Action: Review the Open5GS official repository and tracking issues for the release of a security patch, and apply the update to the SMF component immediately upon availability.

Proactive Monitoring: Monitor network traffic for malformed or unusually large GTP packets directed toward the SMF interface, and review system logs for crashes or unexpected service restarts.

Compensating Controls: Implement network level filtering or stateful inspection to drop non-compliant or malformed GTP packets before they reach the core network infrastructure.

Exploitation Status

Public Exploit Available: Yes — a public proof of concept is available via the researcher write-up linked in the CVE references.

Analyst Notes: As of August 28, 2026, there is no confirmed active exploitation in the wild. The vulnerability is inherently exploitable due to the lack of required authentication and the ease of delivering crafted packets to the public or private interface, which qualifies it as automatable.

Analyst Recommendation

The risk posed by this vulnerability is significant due to its potential to disrupt core network services without requiring authentication. Organizations deploying Open5GS should prioritize tracking the vendor repository for a fix and implement strict packet validation at the network perimeter to mitigate the risk of denial of service attacks until the software can be updated.

---METADATA---
VENDOR: Wavlink
PRODUCT: WL-WN579X3-C
AFFECTED_VERSIONS: Version 231124; see vendor advisory for others.
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in the Wavlink WL-WN579X3-C router, specifically affecting firmware version 231124, potentially allowing for unauthorized system compromise.

Executive Summary:
The Wavlink WL-WN579X3-C router contains a critical vulnerability that could allow an attacker to compromise the device, posing a significant risk to network integrity and data privacy.

Vulnerability Details

CVE-ID: CVE-2026-3715

Affected Software: Wavlink WL-WN579X3-C

Affected Versions: Version 231124

Vulnerability: This vulnerability involves a flaw in the device's firmware processing. Based on the high CVSS score and the nature of the hardware, it likely involves an unauthenticated path that allows for remote command execution or significant configuration manipulation.

Business Impact

A successful exploit of this vulnerability could lead to a total compromise of the network gateway, enabling attackers to intercept traffic, pivot to internal resources, or launch distributed denial-of-service (DDoS) attacks. With a CVSS score of 8.8, the severity is classified as High, reflecting the potential for complete loss of confidentiality and integrity for all data passing through the affected hardware.

Remediation Plan

Immediate Action: Administrators must immediately update the Wavlink WL-WN579X3-C firmware to the latest secure version provided by the vendor to close the vulnerability.

Proactive Monitoring: Review device system logs for unauthorized configuration changes or unusual outbound traffic patterns that may indicate a persistent compromise.

Compensating Controls: If patching is delayed, restrict administrative access to the device's web interface to trusted internal IP addresses only and disable remote management features.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw in a common networking peripheral, the potential for exploitation is high once technical details are reverse-engineered.

Analyst Recommendation

The high CVSS score of 8.8 necessitates an immediate response to prevent unauthorized network access. Organizations using Wavlink hardware should prioritize this firmware update as part of their emergency patch management cycle to mitigate the risk of perimeter breach.

---METADATA---
VENDOR: code-projects
PRODUCT: Simple Flight Ticket Booking System
AFFECTED_VERSIONS: Version 1
---END_METADATA---

Description Summary:
A weakness in code-projects Simple Flight Ticket Booking System version 1 has been identified, potentially allowing for data manipulation or unauthorized access.

Executive Summary:
A high-severity weakness in the Simple Flight Ticket Booking System version 1 poses a risk to the integrity and confidentiality of the booking database.

Vulnerability Details

CVE-ID: CVE-2026-3709

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: Version 1

Vulnerability: This vulnerability represents a distinct weakness from other flaws in the same product version. It likely involves improper input validation, which could be exploited to perform SQL injection or bypass authentication mechanisms within the booking workflow.

Business Impact

With a CVSS score of 7.3, this High severity vulnerability could result in the theft of user credentials or the unauthorized modification of flight prices and booking statuses, leading to financial discrepancies and a loss of organizational integrity.

Remediation Plan

Immediate Action: Update the application to the latest version provided by the vendor to resolve the identified security weakness.

Proactive Monitoring: Monitor database logs for unusual query patterns and implement alerts for failed authentication attempts to the administrative backend.

Compensating Controls: Implement strict input validation and output encoding across the entire application to mitigate the risk of common web-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, the discovery of multiple flaws in the same version suggests a broader need for a security audit of the software.

Analyst Recommendation

The presence of multiple vulnerabilities in version 1 of this software indicates a high risk for any organization using it. We recommend an immediate update and a review of the application's security posture to prevent potential data breaches.

---METADATA---
VENDOR: code-projects
PRODUCT: Simple Flight Ticket Booking System
AFFECTED_VERSIONS: Version 1
---END_METADATA---

Description Summary:
A security flaw in code-projects Simple Flight Ticket Booking System version 1 could lead to unauthorized access to booking records or user data.

Executive Summary:
The Simple Flight Ticket Booking System version 1 is vulnerable to a high-severity flaw that could expose sensitive traveler information and booking details.

Vulnerability Details

CVE-ID: CVE-2026-3708

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: Version 1

Vulnerability: A security flaw has been discovered in version 1 of this booking system. While the specific type is not defined, these systems are often susceptible to Broken Access Control (BAC) or Cross-Site Scripting (XSS), which could allow attackers to view or modify ticket information.

Business Impact

The CVSS score of 7.3 classifies this as a High severity vulnerability. Exploitation could lead to the exposure of Personal Identifiable Information (PII) of travelers, unauthorized ticket cancellations, and significant reputational damage to the service provider.

Remediation Plan

Immediate Action: Apply the latest security patches from code-projects or upgrade to a more modern booking platform.

Proactive Monitoring: Review web server logs for attempts to access booking IDs sequentially or other signs of insecure direct object reference (IDOR) attacks.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious requests and ensure that all user sessions are properly validated before granting access to data.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. These types of open-source projects are often utilized as templates, increasing the potential attack surface.

Analyst Recommendation

Protecting traveler data is a critical requirement for booking systems. Administrators should apply the necessary updates immediately and conduct a thorough review of access control logic to ensure that users can only access their own booking information.

---METADATA---
VENDOR: code-projects
PRODUCT: Simple Flight Ticket Booking System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: OwenW (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349651","name":"VDB-349651 | code-projects Simple Flight Ticket Booking System Adminsearch.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349651","name":"VDB-349651 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.765797","name":"Submit #765797 | code-projects Simple Flight Ticket Booking System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://vuldb.com/?submit.767262","name":"Submit #767262 | code-projects SIMPLE FLIGHT TICKET BOOKING SYSTEM V1.0 SQL Injection (Duplicate)","tags":["third-party-advisory"]},{"url":"https://github.com/Owen-YuanW/CVE/issues/1","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://code-projects.org/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.810Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Simple Flight Ticket Booking System 1.0 allows unauthenticated remote attackers to extract sensitive database information via the flightno parameter in Adminsearch.php.

Executive Summary:
The Simple Flight Ticket Booking System 1.0 is vulnerable to unauthenticated SQL injection, posing a significant risk of unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-3705

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the Adminsearch.php file. An unauthenticated attacker can supply a malicious payload through the flightno GET parameter, which the application fails to sanitize before executing a database query.

Business Impact

Successful exploitation allows an attacker to bypass security controls and extract sensitive information from the backend database, including user credentials and flight records. With a CVSS score of 7.3, this high-severity vulnerability could lead to significant data breaches, loss of customer privacy, and compromise of the underlying server environment.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /Adminsearch.php file or disable the affected module entirely if it is not business critical.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests containing SQL syntax, such as UNION, SELECT, or SLEEP commands directed at the /Adminsearch.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the flightno parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher's GitHub repository referenced in the CVE record.

Analyst Notes: As of March 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the underlying code directly concatenates user-supplied input into a SQL statement.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of remote exploitation, this vulnerability presents an urgent risk. Organizations using this software must implement immediate defensive measures, such as WAF filtering or access restrictions, until a vendor-supplied patch is released and verified. Prioritize the transition to a more secure booking platform if the vendor does not provide timely security updates.

---METADATA---
VENDOR: Wavlink
PRODUCT: NU516U1 Router
AFFECTED_VERSIONS: 251208
---END_METADATA---

Description Summary:
A remote out-of-bounds write vulnerability in the Wavlink NU516U1 router allows attackers to manipulate the ipaddr argument in /cgi-bin/login.cgi, potentially leading to full system compromise.

Executive Summary:
A critical out-of-bounds write vulnerability in Wavlink NU516U1 routers allows remote attackers to execute arbitrary code and gain full control over the device.

Vulnerability Details

CVE-ID: CVE-2026-3703

Affected Software: Wavlink NU516U1

Affected Versions: 251208

Vulnerability: This flaw exists within the sub_401A10 function of the /cgi-bin/login.cgi file. A remote, unauthenticated attacker can manipulate the ipaddr argument to trigger an out-of-bounds write, leading to memory corruption and potential code execution.

Business Impact

A successful exploit allows an external actor to gain unauthorized access to the router’s operating system. This could result in the interception of network traffic, credential theft, or the recruitment of the device into a botnet. The CVSS score of 9.8 reflects the critical nature of this vulnerability due to its remote exploitability and the availability of public exploit code.

Remediation Plan

Immediate Action: Update the router firmware to the latest version provided by Wavlink immediately, as a fix has been professionally released.

Proactive Monitoring: Monitor network traffic for unusual outbound connections and review device logs for suspicious activity originating from the /cgi-bin/login.cgi endpoint.

Compensating Controls: Restrict access to the router’s web management interface from the public internet using a firewall or VPN to minimize the attack surface.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Mar 8, 2026, a public exploit has been released for this vulnerability. Organizations using this hardware must prioritize patching immediately, as the barrier to entry for attackers is significantly lowered by the public disclosure of exploit mechanics.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public exploit, necessitates immediate remediation. Administrators should verify the firmware version of all Wavlink NU516U1 devices and apply the vendor-provided patch without delay to prevent unauthorized remote access.

---METADATA---
VENDOR: H3C
PRODUCT: Magic B1 Router
AFFECTED_VERSIONS: Up to 100R004
---END_METADATA---

Description Summary:
A security vulnerability in the H3C Magic B1 router up to version 100R004 could allow for unauthorized device access or control.

Executive Summary:
H3C Magic B1 routers are affected by a high-severity vulnerability that could allow attackers to compromise the device and the network it serves.

Vulnerability Details

CVE-ID: CVE-2026-3701

Affected Software: H3C Magic B1

Affected Versions: Up to 100R004

Vulnerability: While the specific vulnerability type is not detailed, it affects the Magic B1 router firmware. The CVSS score of 8.8 suggests a significant flaw, likely involving remote access or administrative bypass.

Business Impact

A compromise of a perimeter router like the Magic B1 allows attackers to monitor network traffic, perform man-in-the-middle attacks, or launch further attacks against internal network assets. The CVSS score of 8.8 reflects the high severity of a router-level compromise.

Remediation Plan

Immediate Action: Update the H3C Magic B1 firmware to a version newer than 100R004 immediately.

Proactive Monitoring: Monitor for unusual administrative logins to the router and check for unauthorized changes to DNS or routing settings.

Compensating Controls: Disable remote management features on the WAN interface and restrict local management access to specific trusted IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation. Router vulnerabilities are frequently targeted by state-sponsored actors and botnets once technical details are known.

Analyst Recommendation

Immediate firmware updates are critical for all affected H3C Magic B1 routers. Network administrators should treat this as a high-priority task to ensure the security of the network perimeter.

---METADATA---
VENDOR: gpt-researcher
PRODUCT: gpt-researcher
AFFECTED_VERSIONS: v0.14.7 and before
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-30T14:00:09.744Z
SOURCES_JSON: [{"url":"http://gpt-researcher.com","name":null,"tags":[]},{"url":"https://yerangamage.com/cves/detail/?slug=gptresearcher-websocket-rce","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A critical vulnerability in the gpt-researcher WebSocket endpoint allows unauthenticated remote attackers to execute arbitrary code using malicious Model Context Protocol configurations.

Executive Summary:
An unauthenticated remote code execution vulnerability in gpt-researcher version 0.14.7 and earlier poses a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-37006

Affected Software: gpt-researcher

Affected Versions: v0.14.7 and before

Vulnerability: This flaw exists within the WebSocket endpoint of the application, which fails to properly validate inputs, allowing unauthenticated remote attackers to trigger code execution through malicious Model Context Protocol configurations.

Business Impact

The ability for an unauthenticated attacker to achieve remote code execution represents the most severe security risk, as it allows for complete system takeover. With a CVSS score of 9.8, this vulnerability permits unauthorized access to sensitive data, potential lateral movement within the network, and full control over the affected research instances, leading to significant operational disruption and data loss.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should restrict access to the gpt-researcher WebSocket endpoint at the network or application firewall level until a vendor-supplied update is available.

Proactive Monitoring: Monitor server logs for unusual WebSocket connection patterns or unauthorized requests directed at the research service, particularly those involving Model Context Protocol headers.

Compensating Controls: Implement strict network segmentation and egress filtering to prevent the application from making unauthorized outbound connections if the service is compromised.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 26, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to its nature as an unauthenticated, network-accessible flaw with a total technical impact.

Analyst Recommendation

Given the critical CVSS severity and the ease of exploitation over the network, organizations using gpt-researcher should treat this as a high-priority incident. Until a formal patch is released, ensure the application is not exposed to the public internet and restrict access to trusted internal networks only.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 810G
AFFECTED_VERSIONS: 1.7.7-171114 and prior
CONFIDENCE: high
MISSING: patch
CREDITS: yecp (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349646","name":"VDB-349646 | UTT HiPER 810G formConfigDnsFilterGlobal strcpy buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349646","name":"VDB-349646 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.765750","name":"Submit #765750 | UTT HiPER 810G v3v1.7.7-171114 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/7wkajk/CVE-VUL/blob/main/1.md","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.814Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in the UTT HiPER 810G router due to improper bounds checking in the /goform/formConfigDnsFilterGlobal endpoint.

Executive Summary:
A critical buffer overflow vulnerability in UTT HiPER 810G routers allows authenticated attackers to trigger memory corruption and potential denial of service.

Vulnerability Details

CVE-ID: CVE-2026-3700

Affected Software: UTT HiPER 810G

Affected Versions: 1.7.7-171114 and prior

Vulnerability: The vulnerability is located in the strcpy function within the /goform/formConfigDnsFilterGlobal file. An authenticated attacker can trigger a buffer overflow by supplying an overly long string to the GroupName parameter, which lacks necessary size validation.

Business Impact

Successful exploitation of this flaw can lead to a complete denial of service for the network appliance, impacting connectivity for all downstream users and systems. Given the CVSS score of 8.8, this represents a significant risk to network availability and operational continuity. Unauthorized manipulation of memory structures could also theoretically lead to arbitrary code execution, further compromising the integrity of the gateway device.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should restrict administrative access to the device management interface to trusted IP addresses only and disable unnecessary services. Contact UTT support immediately for firmware updates that address this buffer overflow.

Proactive Monitoring: Review system logs for frequent reboots or crashes of the router, which may indicate exploitation attempts. Monitor HTTP traffic directed at the /goform/formConfigDnsFilterGlobal endpoint for unusually large payloads in the GroupName parameter.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to inspect and block requests to the vulnerable /goform/ formConfigDnsFilterGlobal endpoint that contain suspicious or excessively long string inputs.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in a publicly available security research repository.

Analyst Notes: As of March 9, 2026, there is no confirmed active exploitation in the wild. However, a published proof-of-concept exists via the researcher's write-up, which demonstrates the ability to trigger the buffer overflow through the GroupName parameter. The flaw is highly exploitable due to the lack of input validation in the affected function.

Analyst Recommendation

This vulnerability presents a high risk to the stability of UTT HiPER 810G infrastructure. Organizations using these devices must prioritize limiting administrative access to the web interface immediately while awaiting official vendor patches. Failure to secure these devices could result in significant network outages if the vulnerability is leveraged for denial of service attacks.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 810G
AFFECTED_VERSIONS: UTT HiPER 810G: 1.7.7-171114
CONFIDENCE: high
MISSING: patch
CREDITS: yecp (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349645","name":"VDB-349645 | UTT HiPER 810G formRemoteControl strcpy buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349645","name":"VDB-349645 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.765749","name":"Submit #765749 | UTT HiPER 810G v3v1.7.7-171114 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/7wkajk/CVE-VUL/blob/main/2.md","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.814Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in UTT HiPER 810G allows remote attackers to trigger memory corruption via the /goform/formRemoteControl endpoint.

Executive Summary:
A critical buffer overflow vulnerability in UTT HiPER 810G routers, triggered via the /goform/formRemoteControl endpoint, poses a significant risk of remote code execution or system instability.

Vulnerability Details

CVE-ID: CVE-2026-3699

Affected Software: UTT HiPER 810G

Affected Versions: UTT HiPER 810G: 1.7.7-171114

Vulnerability: The flaw exists in the strcpy function within the /goform/formRemoteControl file, where improper handling of input data leads to a buffer overflow. While the CVSS vector indicates that low privileges are required, the vulnerability can be launched remotely by an authenticated user.

Business Impact

Successful exploitation of this vulnerability allows an attacker to cause a denial of service or potentially achieve remote code execution on the affected router. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full compromise of network traffic routing and internal infrastructure security.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should restrict network access to the router management interface and disable remote management features until the vendor provides a firmware update.

Proactive Monitoring: Monitor device logs for anomalous traffic directed at the /goform/formRemoteControl endpoint and watch for unexpected router reboots or service interruptions.

Compensating Controls: Implement an access control list or Web Application Firewall rule to block unauthorized or suspicious POST requests to the /goform/formRemoteControl URI.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the linked research write-up on GitHub.

Analyst Notes: As of March 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on the Profile parameter during the function call.

Analyst Recommendation

Due to the severity of this buffer overflow and the availability of a public proof-of-concept, immediate defensive action is required. Organizations utilizing UTT HiPER 810G routers should prioritize isolating the management interface from external networks and remain vigilant for vendor security advisories regarding a permanent firmware patch.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 810G
AFFECTED_VERSIONS: 1.7.7-171114 and prior
CONFIDENCE: high
MISSING: patch
CREDITS: yecp (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349644","name":"VDB-349644 | UTT HiPER 810G NTP strcpy buffer overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349644","name":"VDB-349644 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.765748","name":"Submit #765748 | UTT HiPER 810G v3v1.7.7-171114 Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/7wkajk/CVE-VUL/blob/main/3.md","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.814Z
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in the UTT HiPER 810G router allows remote authenticated attackers to cause a denial of service or potentially execute arbitrary code via the /goform/NTP endpoint.

Executive Summary:
A buffer overflow vulnerability in UTT HiPER 810G routers enables authenticated remote attackers to crash the device or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-3698

Affected Software: UTT HiPER 810G

Affected Versions: 1.7.7-171114 and prior

Vulnerability: This memory corruption flaw exists within the strcpy function used in the /goform/NTP handler. The vulnerability is triggered when specific parameters are sent via a POST request, causing a buffer overflow due to an absence of boundary checks, requiring the attacker to have valid administrative credentials.

Business Impact

Successful exploitation of this vulnerability can lead to a complete denial of service of the network infrastructure, disrupting critical business operations. Given the CVSS score of 8.8, the vulnerability poses a high risk to organizational availability and security, as buffer overflows often serve as a precursor to unauthorized remote code execution on the underlying hardware.

Remediation Plan

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict access to the device management interface to trusted internal networks only. If possible, disable the NTP configuration feature until a firmware update is released by UTT.

Proactive Monitoring: Monitor device logs for anomalous POST requests directed at the /goform/NTP endpoint and watch for unexpected router reboots or service instability.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules configured to inspect and block excessively long strings within POST parameters directed at router management interfaces.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the researcher's write-up at the provided GitHub reference.

Analyst Notes: As of March 9, 2026, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the input fields lack sufficient length validation before being processed by the strcpy function.

Analyst Recommendation

The severity of this flaw necessitates immediate attention, particularly in network environments where the router management interface is exposed. Organizations should prioritize restricting administrative access to the device and monitor for any signs of exploitation attempts while awaiting an official firmware update from UTT.

---METADATA---
VENDOR: U-SPEED
PRODUCT: N300 Router
AFFECTED_VERSIONS: V1.0.0
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/kirubel-cve/CVE-2026-36960","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.643Z
---END_METADATA---

Description Summary:
A CSRF vulnerability in the U-SPEED N300 Router V1.0.0 management interface allows attackers to execute administrative actions via a victim's active session.

Executive Summary:
The U-SPEED N300 Router contains a critical Cross-Site Request Forgery (CSRF) vulnerability that allows unauthorized administrative configuration changes when an authenticated user visits a malicious site.

Vulnerability Details

CVE-ID: CVE-2026-36960

Affected Software: U-SPEED N300 Router

Affected Versions: V1.0.0

Vulnerability: This is a Cross-Site Request Forgery (CSRF) flaw where the administrative API lacks anti-CSRF tokens or origin validation, requiring an authenticated administrator to trigger the exploit.

Business Impact

The exploitation of this vulnerability can result in total compromise of the router configuration, potentially leading to unauthorized network access, traffic interception, or complete device takeover. With a CVSS score of 8.8, this high-severity flaw poses a significant risk to network integrity and confidentiality, as an attacker can modify security settings or credentials without the administrator's knowledge.

Remediation Plan

Immediate Action: Since no official patch is currently identified, administrators should restrict access to the router web management interface to trusted management networks only and avoid browsing untrusted websites while logged into the device.

Proactive Monitoring: Review device access logs for unusual administrative changes or requests originating from non-standard IP addresses, and monitor for unauthorized configuration modifications.

Compensating Controls: Implement browser-based security extensions that block cross-site requests or utilize a dedicated management VLAN to isolate the router interface from general user internet traffic.

Exploitation Status

Public Exploit Available: Yes, a published PoC exists, attributed to the technical write-up referenced in the CVE record.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of CSRF tokens makes this device inherently susceptible to browser-based attacks.

Analyst Recommendation

Given the high severity of this vulnerability and the confirmed existence of a public proof-of-concept, users must prioritize securing the management interface immediately. Until the vendor provides a firmware update, administrative access should be strictly limited to prevent attackers from leveraging the CSRF flaw to manipulate device configurations.

---METADATA---
VENDOR: Totolink
PRODUCT: N300RH
AFFECTED_VERSIONS: 6.1c.1353_B20190305
CONFIDENCE: high
MISSING: patch
CREDITS: bozaihuang (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349642","name":"VDB-349642 | Totolink N300RH CGI cstecgi.cgi setWiFiWpsConfig os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349642","name":"VDB-349642 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.765681","name":"Submit #765681 | Totolink N300RHv4 V6.1c.1353_B20190305 OS Command Injection","tags":["third-party-advisory"]},{"url":"https://github.com/JXBbozaihuang/vuln-research/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.totolink.net/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.814Z
---END_METADATA---

Description Summary:
Totolink N300RH routers contain an unauthenticated OS command injection vulnerability in the setWiFiWpsConfig function, allowing remote attackers to execute arbitrary code with root privileges.

Executive Summary:
An unauthenticated remote code execution vulnerability in Totolink N300RH routers poses a critical risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-3696

Affected Software: Totolink N300RH

Affected Versions: 6.1c.1353_B20190305

Vulnerability: This vulnerability is an OS command injection (CWE-78) flaw within the /cgi-bin/cstecgi.cgi endpoint, where the PIN parameter is insufficiently sanitized before being passed to a system command. An unauthenticated attacker can exploit this via the web management interface to execute arbitrary shell commands with root-level privileges.

Business Impact

Successful exploitation grants an attacker full control over the affected router, which can be leveraged to intercept network traffic, pivot into internal networks, or participate in botnet activities. Given the CVSS score of 7.3, this represents a high-severity risk to confidentiality, integrity, and availability of the local network environment.

Remediation Plan

Immediate Action: Since no official vendor patch is currently available, immediately disable the remote web management interface and restrict access to the local network only. If possible, place the device behind a more secure gateway or disable the WPS functionality entirely.

Proactive Monitoring: Monitor device logs for unexpected inbound HTTP requests to /cgi-bin/cstecgi.cgi, particularly those containing shell metacharacters such as backticks, semicolons, or pipe operators.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP traffic containing malicious payloads targeting the WPS configuration parameters.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher's published technical write-up on GitHub.

Analyst Notes: As of March 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no authentication and targets a common administrative function.

Analyst Recommendation

Due to the lack of an available firmware patch, organizations must prioritize network-level mitigations to prevent unauthorized access to the web management interface. Restricting interface access is the most effective way to neutralize this threat until the vendor provides a formal update.

---METADATA---
VENDOR: U-SPEED
PRODUCT: N300 router
AFFECTED_VERSIONS: V1.0.0
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/kirubel-cve/CVE-2026-36959","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.643Z
---END_METADATA---

Description Summary:
The U-SPEED N300 router V1.0.0 lacks rate limiting or account lockout on the login endpoint, allowing unauthenticated attackers to perform brute-force attacks on the administrator account.

Executive Summary:
The U-SPEED N300 router is vulnerable to unauthenticated brute-force attacks due to missing rate limiting, which could lead to unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-36959

Affected Software: U-SPEED N300 router

Affected Versions: V1.0.0

Vulnerability: This vulnerability is a lack of authentication protection mechanisms on the /api/login endpoint. An unauthenticated attacker on the local network can conduct unlimited authentication attempts, facilitating unauthorized access to the router management interface.

Business Impact

The absence of rate limiting allows for high-speed brute-force attacks against the administrative credentials of the device. A successful compromise grants the attacker full control over the router, potentially leading to unauthorized network access, traffic interception, or complete device takeover. With a CVSS score of 7.5, this high-severity vulnerability poses a significant risk to the security and integrity of internal network communications.

Remediation Plan

Immediate Action: Since no official vendor patch is currently confirmed, administrators should restrict access to the router management interface to trusted IP addresses only. Disable remote management features if they are not strictly required for business operations.

Proactive Monitoring: Monitor device access logs for high volumes of failed login attempts originating from a single source or unusual patterns of activity directed at the /api/login endpoint.

Compensating Controls: Implement network-level access control lists (ACLs) to isolate the management interface from untrusted segments of the network. If the router supports it, utilize a VPN for any necessary remote administrative access rather than exposing the interface to the local or wide area network.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research reference provided by the CVE record.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit given the lack of defensive measures on the authentication endpoint.

Analyst Recommendation

Given the high-severity nature of this vulnerability and the availability of a proof-of-concept, immediate action is required to harden the device configuration. Administrators must limit exposure of the management interface to mitigate the risk of unauthorized access while awaiting potential vendor remediation.

---METADATA---
VENDOR: U-SPEED
PRODUCT: N300 V1.0.0 wireless router
AFFECTED_VERSIONS: V1.0.0
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/kirubel-cve/CVE-2026-36958","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.643Z
---END_METADATA---

Description Summary:
An unauthenticated denial-of-service vulnerability in the U-SPEED N300 V1.0.0 router allows resource exhaustion of the embedded Boa HTTP server via high-volume concurrent requests.

Executive Summary:
A critical denial-of-service vulnerability in the U-SPEED N300 V1.0.0 wireless router allows unauthenticated attackers to crash the management interface via resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-36958

Affected Software: U-SPEED N300 V1.0.0 wireless router

Affected Versions: V1.0.0

Vulnerability: This vulnerability affects the embedded Boa HTTP server, where an unauthenticated attacker can send a large volume of concurrent HTTP requests to arbitrary endpoints, leading to system resource exhaustion and interface unresponsiveness.

Business Impact

Successful exploitation results in the loss of availability for the router management interface, requiring a manual reboot to restore functionality. With a CVSS score of 7.5, this high-severity flaw poses a significant operational risk, as attackers can repeatedly disrupt network administration capabilities, potentially facilitating further malicious activities or network downtime.

Remediation Plan

Immediate Action: Restrict access to the router web management interface to trusted internal IP addresses only, as no vendor patch is currently confirmed.

Proactive Monitoring: Monitor network traffic for unusual spikes in concurrent HTTP requests directed at the router management interface.

Compensating Controls: Implement rate limiting on the network perimeter or place the management interface behind a firewall to mitigate high-volume request attacks.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists, attributed to the research write-up referenced in the CVE record.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication and the resource-constrained nature of the target embedded server.

Analyst Recommendation

Given the availability of a proof-of-concept and the ease of exploitation, organizations using the U-SPEED N300 V1.0.0 should prioritize hardening the management interface immediately. Since a patch is not yet confirmed, limiting administrative access to authorized management segments is the most effective method to reduce the attack surface and maintain business continuity.

---METADATA---
VENDOR: Dbit
PRODUCT: N300 T1 Pro Easy Setup Wireless Wi-Fi Router
AFFECTED_VERSIONS: V1.0.0
CONFIDENCE: high
MISSING: patch, technical_details
SOURCES_JSON: [{"url":"https://github.com/kirubel-cve/CVE-2026-36957","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.643Z
---END_METADATA---

Description Summary:
The Dbit N300 T1 Pro router is susceptible to a denial of service attack via the boa web server, allowing unauthenticated attackers to crash the device through high-volume HTTP GET request flooding.

Executive Summary:
The Dbit N300 T1 Pro router is vulnerable to a denial of service attack that can disable all routing capabilities and management access via unauthenticated network requests.

Vulnerability Details

CVE-ID: CVE-2026-36957

Affected Software: Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router

Affected Versions: V1.0.0

Vulnerability: The vulnerability exists within the boa web server URI handler, where the device fails to properly manage resources under high request volume. An unauthenticated remote attacker can trigger a kernel deadlock by flooding the device with HTTP GET requests for non-existent URIs.

Business Impact

Successful exploitation of this vulnerability results in a total denial of service, rendering the router unresponsive and disrupting all network traffic passing through the device. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to business continuity, as it allows even low-skilled, unauthenticated attackers to cause complete system downtime.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the router management interface to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for unusual spikes in HTTP GET requests directed at the router, particularly those targeting non-existent or malformed URIs.

Compensating Controls: Implement rate-limiting on the perimeter firewall or utilize an Intrusion Prevention System to detect and drop excessive connection attempts originating from untrusted sources.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is available via the linked researcher repository on GitHub.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of authentication requirements and the simple nature of the flood attack.

Analyst Recommendation

The potential for complete network disruption makes this vulnerability a high priority for organizations utilizing this hardware. While a vendor patch is currently missing, immediate network segmentation and strict access controls are necessary to prevent remote attackers from reaching the vulnerable management interface.

---METADATA---
VENDOR: Dbit
PRODUCT: N300 T1 Pro wireless router
AFFECTED_VERSIONS: V1.0.0
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/kirubel-cve/CVE-2026-36956","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.643Z
---END_METADATA---

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in the Dbit N300 T1 Pro router allows attackers to perform unauthorized administrative actions by tricking authenticated users into visiting malicious sites.

Executive Summary:
The Dbit N300 T1 Pro wireless router contains a critical CSRF vulnerability that enables unauthenticated attackers to execute arbitrary administrative actions via a victim's active session.

Vulnerability Details

CVE-ID: CVE-2026-36956

Affected Software: Dbit N300 T1 Pro wireless router

Affected Versions: V1.0.0

Vulnerability: The device lacks anti-CSRF tokens and proper request validation on administrative API endpoints, such as /api/setWlan. An attacker can force an authenticated administrator's browser to execute unauthorized configuration changes by enticing the user to visit a malicious webpage.

Business Impact

Successful exploitation allows an attacker to modify critical router configurations, which could lead to complete device compromise, interception of network traffic, or unauthorized access to internal network resources. With a CVSS score of 8.8, this vulnerability poses a significant risk to organizational infrastructure, as it facilitates remote management of the device by unauthorized parties.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the web management interface to trusted IP addresses only and disable remote management features.

Proactive Monitoring: Monitor network access logs for suspicious requests originating from internal administrative sessions or unexpected traffic patterns directed at configuration endpoints.

Compensating Controls: Implement an egress filtering policy and ensure that administrative users do not browse untrusted websites while logged into the router's management console.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the researcher's GitHub repository.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of standard CSRF mitigation controls in the firmware.

Analyst Recommendation

Given the lack of a vendor-provided patch, users must treat this device as high risk. Organizations should immediately isolate the management interface from the public internet and enforce strict access control lists to prevent unauthorized exploitation of this flaw.

---METADATA---
VENDOR: Shy2593666979
PRODUCT: AgentChat
AFFECTED_VERSIONS: Up to version 2
---END_METADATA---

Description Summary:
A security flaw in Shy2593666979 AgentChat up to version 2 has been identified, potentially allowing for unauthorized system manipulation.

Executive Summary:
A vulnerability in the AgentChat software up to version 2 poses a high risk to application security and could lead to unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-3693

Affected Software: Shy2593666979 AgentChat

Affected Versions: Up to version 2

Vulnerability: A flaw has been identified in the AgentChat application. Although the specific vulnerability type is not detailed, the affected versions suggest an issue in the legacy codebase that could be leveraged by an attacker to bypass security controls or execute unauthorized commands.

Business Impact

The CVSS score of 7.3 indicates a High severity risk. If exploited, this vulnerability could compromise the confidentiality of communications within the AgentChat platform or allow an attacker to gain unauthorized access to the user database, resulting in reputational damage and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Upgrade AgentChat to a version higher than 2.0 or apply the vendor-recommended security patch immediately.

Proactive Monitoring: Monitor for anomalous chat logs or unexpected API calls that deviate from standard user behavior.

Compensating Controls: Ensure that the application is deployed behind a secure gateway and that all user inputs are strictly validated at the server level.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. The lack of detailed public disclosure may temporarily limit exploitation, but the risk remains high for outdated versions.

Analyst Recommendation

Organizations using AgentChat must verify their current version and upgrade immediately if they are running version 2 or lower. Securing communication tools is essential for maintaining corporate privacy and preventing unauthorized data disclosure.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Canvas
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in OpenClaw Canvas allows unauthorized access to the application.

Executive Summary:
An authentication bypass vulnerability in OpenClaw Canvas poses a severe risk, potentially allowing unauthorized access to sensitive application functionality.

Vulnerability Details

CVE-ID: CVE-2026-3690

Affected Software: OpenClaw Canvas

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an authentication bypass vulnerability that allows an attacker to circumvent existing security checks, potentially accessing restricted areas of the application without valid credentials.

Business Impact

Successful exploitation could result in unauthorized access to sensitive data and administrative functions within the Canvas application. With a CVSS score of 7.4, the vulnerability represents a high-risk entry point for attackers to compromise user accounts or perform unauthorized actions, leading to potential data breaches and service disruption.

Remediation Plan

Immediate Action: Apply the vendor-supplied security update immediately to patch the authentication bypass mechanism.

Proactive Monitoring: Analyze application access logs for suspicious patterns, such as successful access to protected areas without corresponding authentication events.

Compensating Controls: Implement Web Application Firewall (WAF) rules to detect and block requests that attempt to bypass authentication headers or parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate action is necessary to close this authentication loophole. Security teams should prioritize patching the OpenClaw Canvas application to prevent unauthorized access and protect the confidentiality and integrity of the data managed within the platform.

---METADATA---
VENDOR: wclovers
PRODUCT: WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
AFFECTED_VERSIONS: 0 through 2.11.10
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The WCFM Membership plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to bypass authorization controls.

Executive Summary:
An Insecure Direct Object Reference vulnerability in the WCFM Membership plugin allows authenticated users to perform unauthorized actions, risking data integrity.

Vulnerability Details

CVE-ID: CVE-2026-3688

Affected Software: wclovers WCFM Membership – WooCommerce Memberships for Multivendor Marketplace

Affected Versions: 0 through 2.11.10

Vulnerability: This is an IDOR vulnerability where the plugin fails to perform adequate authorization checks on user-controlled keys. An authenticated user with low privileges can manipulate requests to access or modify data they are not authorized to interact with.

Business Impact

This vulnerability can lead to unauthorized data manipulation or access within the multivendor marketplace. With a CVSS score of 8.1, the flaw significantly impacts the integrity of the platform, potentially allowing vendors to access or modify membership data belonging to others.

Remediation Plan

Immediate Action: Immediately update the WCFM Membership plugin to the latest available version provided by the vendor.

Proactive Monitoring: Monitor site traffic and application logs for unusual request patterns targeting membership or user management endpoints.

Compensating Controls: If a patch is not immediately applicable, implement a Web Application Firewall (WAF) rule to block unauthorized access attempts to plugin-specific API endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Plugin vulnerabilities in e-commerce environments are frequently targeted. Administrators must verify their current plugin version and apply the vendor-provided update immediately to prevent unauthorized access and potential business logic abuse.

---METADATA---
VENDOR: UnPoller
PRODUCT: UnPoller
AFFECTED_VERSIONS: 2.33.0
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/unpoller/unpoller","name":null,"tags":[]},{"url":"https://github.com/SyntaxSaiyan/CVE-2026-36851","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A path traversal vulnerability in the UnPoller 2.33.0 password field allows unauthenticated attackers to perform arbitrary file reads and network exfiltration.

Executive Summary:
A critical path traversal vulnerability in UnPoller 2.33.0 allows unauthenticated attackers to read sensitive files and exfiltrate data from the host system.

Vulnerability Details

CVE-ID: CVE-2026-36851

Affected Software: UnPoller UnPoller

Affected Versions: 2.33.0

Vulnerability: The application fails to properly sanitize user input in the password field, enabling a path traversal attack. This flaw allows an unauthenticated, remote attacker to read arbitrary files on the underlying filesystem.

Business Impact

The ability to read arbitrary files poses a significant risk to organizational confidentiality, as attackers may extract sensitive configuration files, credentials, or system data. With a CVSS score of 7.5, this high-severity vulnerability could lead to total system compromise or lateral movement within the network.

Remediation Plan

Immediate Action: Monitor the vendor repository for the release of a security patch and apply it immediately upon availability. If no patch is available, restrict access to the UnPoller interface to trusted internal networks only.

Proactive Monitoring: Review web server and application logs for suspicious request patterns, specifically looking for directory traversal sequences like dot-dot-slash in password or authentication fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts containing directory traversal sequences.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub (SyntaxSaiyan/CVE-2026-36851).

Analyst Notes: As of August 26, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the exposure of sensitive files and the availability of a public proof-of-concept, this vulnerability represents a substantial risk. Administrators must prioritize limiting access to the affected service while awaiting a vendor-supplied patch to ensure the security of the host environment.

---METADATA---
VENDOR: Gigamon
PRODUCT: GVOS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Gigamon GVOS v5 contains a vulnerability that may expose the system to unauthorized access or operational disruption.

Executive Summary:
Gigamon GVOS v5 is affected by a high-severity vulnerability that poses a significant risk to the integrity and availability of network visibility infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-36848

Affected Software: Gigamon GVOS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists within the GVOS operating system, though specific technical triggers remain under investigation. Given the nature of network visibility appliances, an attacker may leverage this flaw to gain unauthorized system-level access or disrupt critical traffic monitoring functions.

Business Impact

A successful exploit could lead to full system compromise of the network visibility appliance, potentially allowing attackers to intercept or manipulate network traffic data. With a CVSS score of 7.5, this high-severity flaw represents a substantial threat to organizational security posture and data confidentiality.

Remediation Plan

Immediate Action: Monitor official Gigamon security channels for the release of a patch and apply it to all affected GVOS appliances immediately upon availability.

Proactive Monitoring: Review system access logs for anomalous login attempts or unauthorized configuration changes within the GVOS management interface.

Compensating Controls: Restrict management access to the GVOS appliance to trusted administrative subnets and implement strict firewall rules to prevent exposure to untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical role of Gigamon appliances in network architecture, the potential for exploitation remains high.

Analyst Recommendation

Organizations utilizing Gigamon GVOS must prioritize this vulnerability. It is recommended to perform an immediate audit of exposed appliances and ensure that security patches are applied as soon as the vendor makes them available to prevent potential unauthorized access.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: N200RE V5
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A command injection vulnerability in the TOTOLINK N200RE V5 router allows remote code execution via specifically crafted parameters in the formMapDelDevice function.

Executive Summary:
A critical command injection vulnerability in the TOTOLINK N200RE V5 allows unauthenticated remote attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-36841

Affected Software: TOTOLINK N200RE V5

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The device fails to properly sanitize input for the 'macstr' and 'bandstr' parameters within the 'formMapDelDevice' function, enabling command injection.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating the highest level of risk. An attacker can gain full control over the affected networking hardware, leading to total network compromise, data interception, and the potential to use the device as a pivot point for further internal network attacks.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by TOTOLINK to address the command injection flaw.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or attempts to access administrative functions from unexpected sources.

Compensating Controls: Disable remote management interfaces on the WAN side and restrict access to the device management console to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical security risk requiring immediate mitigation. Administrators must ensure the affected firmware is patched immediately to prevent full device compromise by unauthenticated remote actors.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: A3002RU V3
AFFECTED_VERSIONS: V3.0.0-B20220304.1804 and prior
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/0xmania/cve/tree/main/TOTOLINK-A3002RUV3.0-boa-formMapDelDevice-StackOverflow","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.659Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the TOTOLINK A3002RU V3 allows unauthenticated attackers to cause a denial of service via the hostname parameter in the formMapDelDevice function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in TOTOLINK A3002RU V3 routers allows unauthenticated remote attackers to crash the device, posing a significant availability risk.

Vulnerability Details

CVE-ID: CVE-2026-36837

Affected Software: TOTOLINK A3002RU V3

Affected Versions: V3.0.0-B20220304.1804 and prior

Vulnerability: The device is susceptible to a stack-based buffer overflow triggered by sending a crafted request to the hostname parameter within the formMapDelDevice function. This flaw is exploitable by an unauthenticated attacker over the network.

Business Impact

The exploitation of this vulnerability results in a denial of service, which can lead to critical network downtime for users relying on the affected hardware. Given the CVSS score of 7.5, this high-severity flaw poses a substantial risk to operational continuity, especially for organizations that use these devices as primary network gateways.

Remediation Plan

Immediate Action: Monitor official TOTOLINK support channels for the release of a firmware update that addresses the buffer overflow in the formMapDelDevice function and apply it immediately upon availability.

Proactive Monitoring: Inspect network traffic for abnormal patterns directed at the device administration interface and review system logs for recurring service crashes or unexpected reboots.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses only, and implement a firewall policy to block unsolicited traffic from the internet to the device management ports.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the researcher write-up linked in the CVE references.

Analyst Notes: As of May 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote code execution or service disruption via a simple parameter injection.

Analyst Recommendation

Organizations utilizing the TOTOLINK A3002RU V3 should verify the current firmware version and prepare for immediate deployment of patches. Given the availability of a public proof-of-concept, the attack surface should be minimized by isolating the management interface from public-facing networks until a formal vendor fix is applied.

---METADATA---
VENDOR: Panabit
PRODUCT: PAP-XM320
AFFECTED_VERSIONS: Up to and including v7.7
---END_METADATA---

Description Summary:
An authentication bypass vulnerability in the Panabit PAP-XM320 embedded HTTP server allows attackers to bypass login requirements via directory traversal.

Executive Summary:
A critical authentication bypass vulnerability in the Panabit PAP-XM320 embedded HTTP server allows unauthenticated attackers to gain unauthorized access to the system.

Vulnerability Details

CVE-ID: CVE-2026-36829

Affected Software: Panabit PAP-XM320

Affected Versions: Up to and including v7.7

Vulnerability: The embedded HTTP server improperly validates session cookies by checking for file existence using user-controlled input. This allows for directory traversal and successful bypass of authentication.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an existential threat to the device, as an attacker can gain full administrative access without credentials. This can lead to the complete compromise of the network appliance and any traffic passing through it.

Remediation Plan

Immediate Action: Update the Panabit PAP-XM320 firmware to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor management interface access logs for signs of directory traversal attempts or unauthorized login bypasses.

Compensating Controls: Place the device management interface behind a VPN or restricted network segment to prevent exposure to untrusted networks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to bypass authentication on a network appliance is extremely high risk. Organizations using the Panabit PAP-XM320 must prioritize firmware updates and ensure the management interface is not accessible from the public internet.

---METADATA---
VENDOR: Panabit
PRODUCT: PAP-XM320
AFFECTED_VERSIONS: Up to and including v7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in the Panabit PAP-XM320 /cgi-bin/tools/ajax_cmd endpoint allows authenticated attackers to execute arbitrary system commands.

Executive Summary:
A critical command injection vulnerability in Panabit PAP-XM320 allows authenticated attackers to achieve total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-36828

Affected Software: Panabit PAP-XM320

Affected Versions: Up to and including v7

Vulnerability: The vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint, which fails to properly validate input, allowing an authenticated user to execute arbitrary shell commands on the underlying operating system.

Business Impact

The ability to execute arbitrary commands on a network device like the PAP-XM320 poses a severe risk, as it allows for full control of the device, potential lateral movement into the internal network, and interception of traffic. With a CVSS score of 8.8, this vulnerability is highly dangerous; unauthorized access to administrative functions could lead to a total loss of confidentiality, integrity, and availability of the affected system.

Remediation Plan

Immediate Action: Monitor vendor communication channels for security updates and apply them immediately upon release to remediate the command injection flaw.

Proactive Monitoring: Audit device access logs for unusual administrative activity and monitor for unauthorized command execution patterns or unexpected system process creation.

Compensating Controls: Restrict access to the device management interface to only trusted administrative IP addresses via firewall rules to reduce the likelihood of unauthorized exploitation.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of May 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly severe given the potential for remote code execution.

Analyst Recommendation

Given the existence of a proof-of-concept and the high CVSS severity, this vulnerability should be treated with extreme urgency. Administrators must restrict access to the management interface and apply vendor patches the moment they become available.

---METADATA---
VENDOR: Tenda
PRODUCT: FH451
AFFECTED_VERSIONS: 1.0.0.9
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349581","name":"VDB-349581 | Tenda FH451 QuickIndex formQuickIndex stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349581","name":"VDB-349581 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.765331","name":"Submit #765331 | Tenda FH451 V1.0.0.9 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/FH451/vul_63/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.814Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda FH451 router allows remote attackers to trigger memory corruption and potential code execution via the formQuickIndex function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda FH451 firmware version 1.0.0.9 poses a high risk of remote code execution or denial of service.

Vulnerability Details

CVE-ID: CVE-2026-3679

Affected Software: Tenda FH451

Affected Versions: 1.0.0.9

Vulnerability: This vulnerability is a stack-based buffer overflow located in the formQuickIndex function within the /goform/QuickIndex file. By sending a specially crafted POST request containing excessively long inputs in the mit_linktype or PPPOEPassword parameters, a low-privileged authenticated attacker can trigger memory corruption, potentially leading to remote code execution or system instability.

Business Impact

The exploitation of this vulnerability could lead to a total compromise of the affected router, allowing an attacker to gain unauthorized control over network traffic or disrupt critical business connectivity. Given the CVSS score of 8.8, this flaw represents a significant risk to organizational infrastructure, as successful exploitation results in complete loss of confidentiality, integrity, and availability for the affected device.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the management interface of the Tenda FH451 device to trusted internal management networks only.

Proactive Monitoring: Monitor device logs for anomalous POST requests directed at the /goform/QuickIndex endpoint and watch for unexpected device reboots or service failures.

Compensating Controls: Deploy a Web Application Firewall or network-level access control list to filter or block requests containing abnormally long parameter values sent to the /goform/QuickIndex path.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept has been published in the researcher's technical write-up on GitHub.

Analyst Notes: As of March 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment and the publicly available proof-of-concept code, the exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length validation on the user-provided parameters.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a severe threat to network security. Organizations currently utilizing the Tenda FH451 should prioritize isolating these devices from external networks and remain vigilant for vendor-supplied firmware updates to remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: FH451
AFFECTED_VERSIONS: 1.0.0.9
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349580","name":"VDB-349580 | Tenda FH451 AdvSetWan sub_3C434 stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349580","name":"VDB-349580 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.765330","name":"Submit #765330 | Tenda FH451 V1.0.0.9 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/FH451/vul_62/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.814Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Tenda FH451 version 1.0.0.9 allows remote attackers to trigger a denial of service or execute arbitrary code via the /goform/AdvSetWan endpoint.

Executive Summary:
A critical stack-based buffer overflow in the Tenda FH451 router allows for remote code execution via unauthenticated manipulation of the PPPOEPassword parameter.

Vulnerability Details

CVE-ID: CVE-2026-3678

Affected Software: Tenda FH451

Affected Versions: 1.0.0.9

Vulnerability: The vulnerability exists in the sub_3C434 function within the /goform/AdvSetWan endpoint, where the application fails to perform length validation on the wanmode or PPPOEPassword arguments. This allows an attacker to overwrite the stack, potentially leading to remote code execution or a denial of service condition.

Business Impact

The ability to achieve remote code execution on network infrastructure devices poses a severe threat to business continuity and data integrity. An attacker gaining control of a router can intercept internal traffic, pivot into the local network, or render the device unresponsive, resulting in significant downtime. Given the CVSS score of 8.8, this vulnerability represents a high-risk entry point for unauthorized access to internal resources.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the web management interface of the Tenda FH451 to trusted internal IP addresses only.

Proactive Monitoring: Monitor device logs for anomalous traffic patterns directed at the /goform/AdvSetWan endpoint, particularly those involving excessive payload sizes or unexpected characters in POST requests.

Compensating Controls: Deploy a network-based intrusion detection system or a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing unusually long strings within the PPPOEPassword parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the research write-up provided by the vulnerability reporter.

Analyst Notes: As of March 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the affected function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability should be treated with high urgency. Organizations utilizing the Tenda FH451 should immediately isolate the device management interface from external exposure and monitor for official firmware updates from the vendor to remediate the underlying memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: FH451
AFFECTED_VERSIONS: 1.0.0.9
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/?id.349579","name":"VDB-349579 | Tenda FH451 setcfm fromSetCfm stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.349579","name":"VDB-349579 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.765329","name":"Submit #765329 | Tenda FH451 V1.0.0.9 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vul_db/blob/main/FH451/vul_61/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:38.814Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Tenda FH451 version 1.0.0.9 allows remote attackers to trigger memory corruption and potential code execution via the /goform/setcfm endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda FH451 router enables remote attackers to achieve denial of service or arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-3677

Affected Software: Tenda FH451

Affected Versions: 1.0.0.9

Vulnerability: The vulnerability exists in the fromSetCfm function within the /goform/setcfm endpoint, where improper validation of the funcname and funcpara1 parameters leads to a stack-based buffer overflow. While the CVSS vector indicates low privilege requirements (PR:L), the flaw allows for remote memory corruption via HTTP POST requests.

Business Impact

The ability for an unauthenticated or low-privileged remote attacker to execute arbitrary code on networking hardware poses a severe risk to organizational infrastructure. Successful exploitation could lead to total compromise of the device, enabling traffic interception, lateral movement into internal networks, or persistent denial of service. Given the high CVSS score of 8.8, immediate remediation is required to prevent unauthorized access to sensitive network traffic.

Remediation Plan

Immediate Action: Contact Tenda support to verify if a firmware patch exists for the 1.0.0.9 version, as no public fix is currently confirmed. If no patch is available, restrict access to the device management interface to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/setcfm endpoint, particularly those containing excessively long parameter strings.

Compensating Controls: Implement a Web Application Firewall (WAF) or intrusion detection rule to filter and block oversized inputs sent to the /goform/setcfm administrative interface.

Exploitation Status

Public Exploit Available: Yes, a functional Proof of Concept (PoC) exists as documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation in the wild. However, per CISA's SSVC assessment, a proof-of-concept exists, and the availability of a public PoC makes the exploitation risk credible. The vulnerability is inherently exploitable due to the lack of length checks on user-supplied parameters before memory copy operations.

Analyst Recommendation

The severity of this vulnerability necessitates a proactive posture. Administrators should immediately isolate affected devices from external network exposure and monitor for any suspicious activity targeting administrative endpoints. In the absence of an official vendor patch, restricting management access to authorized users is the most effective temporary measure to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Shopizer
PRODUCT: Shopizer
AFFECTED_VERSIONS: v3.2.5
---END_METADATA---

Description Summary:
A path traversal vulnerability in Shopizer v3.2.5 allows remote attackers to write arbitrary files to any writable path via the image upload endpoint.

Executive Summary:
A critical path traversal vulnerability in Shopizer enables remote attackers to write arbitrary files to the server, resulting in potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-36767

Affected Software: Shopizer

Affected Versions: v3.2.5

Vulnerability: The /content/images/add endpoint lacks sufficient path sanitization. An attacker can submit a crafted POST request to bypass directory restrictions and write files to unintended locations.

Business Impact

With a CVSS score of 10.0, this vulnerability is of the highest urgency. Successful exploitation allows an attacker to write malicious payloads, such as webshells, to the server. This can lead to complete system takeover, unauthorized access to customer databases, and significant reputational harm.

Remediation Plan

Immediate Action: Patch or upgrade Shopizer to the latest version immediately to resolve the path traversal vulnerability.

Proactive Monitoring: Monitor server logs for POST requests to the image upload endpoint that contain path traversal patterns (e.g., ../).

Compensating Controls: Use a WAF to inspect and block incoming HTTP requests containing directory traversal sequences directed at the image upload endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, there is no verified evidence of active exploitation. However, the critical nature of this flaw makes it a primary target for automated scanning and exploitation tools.

Analyst Recommendation

This vulnerability requires immediate intervention. Security teams must ensure that all instances of Shopizer are updated and that file system integrity is verified to ensure no unauthorized files have been planted.

---METADATA---
VENDOR: JeeSite
PRODUCT: JeeSite
AFFECTED_VERSIONS: v5.15.1
---END_METADATA---

Description Summary:
Authenticated attackers with file upload permissions can exploit a path traversal vulnerability in JeeSite v5.15.1 to upload arbitrary files to the filesystem.

Executive Summary:
A high-severity path traversal vulnerability in JeeSite allows authenticated attackers to perform unauthorized file writes, potentially leading to remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-36760

Affected Software: JeeSite

Affected Versions: v5.15.1

Vulnerability: The fileMd5 parameter in the /a/file/upload endpoint fails to properly sanitize path inputs. When chunked upload is enabled, an authenticated attacker can write files to arbitrary locations on the server.

Business Impact

This vulnerability carries a CVSS score of 9.6. While it requires authentication, the ability to write arbitrary files allows an attacker to upload malicious scripts (webshells) into executable directories, resulting in full server compromise, data exfiltration, or persistence within the environment.

Remediation Plan

Immediate Action: Upgrade to the latest version of JeeSite that addresses the path traversal flaw in the file upload module.

Proactive Monitoring: Audit the filesystem for unexpected files in upload directories and monitor logs for unusual file upload activity or traversal attempts.

Compensating Controls: Restrict file upload permissions to authorized users only and implement strict validation of file paths and extensions at the application layer.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 30, 2026, there is no public information indicating active exploitation. However, the high CVSS score necessitates immediate patch management.

Analyst Recommendation

Organizations should prioritize updating their JeeSite instances. Furthermore, review current user roles and permissions to ensure that the principle of least privilege is enforced regarding file upload capabilities.

---METADATA---
VENDOR: EDIMAX
PRODUCT: BR-6428nS V3
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
The EDIMAX BR-6428nS V3 router is affected by a high-severity vulnerability that could allow unauthorized remote access and total system compromise.

Executive Summary:
A critical vulnerability in the EDIMAX BR-6428nS V3 router exposes the device to unauthorized remote control and potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-36734

Affected Software: EDIMAX BR-6428nS V3

Affected Versions: See vendor advisory

Vulnerability: This is a network-accessible vulnerability that allows an authenticated user to perform actions leading to a full compromise of the device's confidentiality, integrity, and availability.

Business Impact

Successful exploitation allows an attacker to gain full control over the network hardware, which can be used to intercept traffic, pivot into internal networks, or disrupt connectivity. With a CVSS score of 8.8, this vulnerability represents a severe risk to network infrastructure and perimeter security.

Remediation Plan

Immediate Action: Check the EDIMAX official support portal for firmware updates and apply them immediately to the affected router hardware.

Proactive Monitoring: Monitor router logs for unauthorized configuration changes, unexpected administrative logins, or unusual outbound traffic from the device.

Compensating Controls: Restrict administrative access to the router’s web interface to a dedicated management VLAN or trusted IP addresses to limit exposure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the high level of control granted upon successful exploitation.

Analyst Recommendation

Given the critical nature of router-based vulnerabilities, immediate firmware updates are required to secure the device. Network administrators should ensure that administrative interfaces are not exposed to the public internet and that all firmware is kept current to mitigate this high-severity risk.

---METADATA---
VENDOR: Bookcars
PRODUCT: Bookcars
AFFECTED_VERSIONS: bookcars version 8.3
---END_METADATA---

Description Summary:
An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows for directory traversal and potential arbitrary file manipulation.

Executive Summary:
An unrestricted file rename vulnerability in bookcars version 8.3 allows authenticated attackers to perform directory traversal, posing a significant risk of unauthorized access or remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-36723

Affected Software: Bookcars Bookcars

Affected Versions: bookcars version 8.3

Vulnerability: This vulnerability resides in the /api/create-user component, where improper validation of file rename operations enables directory traversal sequences. While the attack requires authentication, the ability to move files to arbitrary locations on the server filesystem facilitates system-level compromise.

Business Impact

The severity of this flaw is reflected in its CVSS score of 8.8, which indicates a high potential for severe impact. Successful exploitation could allow an attacker to overwrite critical system files or achieve remote code execution, leading to full system compromise, data theft, and significant operational downtime.

Remediation Plan

Immediate Action: Apply the vendor-released patch that fixes the file rename handling in bookcars v8.3, or update the software to a version that addresses this vulnerability.

Proactive Monitoring: Review application access logs for suspicious API requests containing directory traversal patterns (e.g., ../) directed at the /api/create-user endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal sequences and restrict unauthorized access to administrative API endpoints.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 11, 2026, public exploits for this vulnerability are available. Given the potential for remote code execution and the availability of exploit code, organizations must prioritize patching this vulnerability immediately.

Analyst Recommendation

Due to the high CVSS score of 8.8 and the confirmed availability of public exploit material, this vulnerability poses an immediate and elevated risk. Administrators should audit their current version of bookcars and apply the necessary patches immediately to prevent potential system-wide compromise.

---METADATA---
VENDOR: OpenSIPS
PRODUCT: Control Panel (opensips-cp)
AFFECTED_VERSIONS: prior to version 9.3.3
---END_METADATA---

Description Summary:
A Time-Based Blind SQL Injection vulnerability exists in the alias_management module of the OpenSIPS Control Panel.

Executive Summary:
An authenticated SQL injection vulnerability in OpenSIPS Control Panel allows attackers to extract sensitive database information via the alias_management module.

Vulnerability Details

CVE-ID: CVE-2026-36670

Affected Software: OpenSIPS Control Panel

Affected Versions: prior to version 9.3.3

Vulnerability: The alias_management module fails to properly sanitize user inputs, enabling a Time-Based Blind SQL Injection. An authenticated attacker can execute arbitrary SQL commands by manipulating parameters within this module.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk of data breach and unauthorized database modification. Successful exploitation could lead to full database compromise, where sensitive configuration or user data is exfiltrated or manipulated, undermining the security of the entire telephony infrastructure.

Remediation Plan

Immediate Action: Update OpenSIPS Control Panel to version 9.3.3 or later immediately.

Proactive Monitoring: Enable database query logging and monitor for unusual query execution times, which are indicative of time-based injection attacks.

Compensating Controls: Use a Web Application Firewall (WAF) with SQL injection detection rules to inspect and block malicious input directed at the alias_management module.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 17, 2026, a public exploit is available for this vulnerability. Given the ease of exploitation, the risk to unpatched systems is critical.

Analyst Recommendation

The availability of a public exploit significantly elevates the risk associated with this vulnerability. Organizations using OpenSIPS Control Panel must upgrade to version 9.3.3 immediately. Security teams should perform a forensic review of database logs to determine if unauthorized access has already occurred.

---METADATA---
VENDOR: Feng Office
PRODUCT: Feng Office
AFFECTED_VERSIONS: 3.11.13.11
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.fengoffice.com/","name":null,"tags":[]},{"url":"https://github.com/firstlax6t/CVE-2026-36669-FengOffice","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An unauthenticated arbitrary file upload vulnerability in the ck_upload_handler.php file of Feng Office 3.11.13.11 allows remote attackers to upload malicious files to a web-accessible directory.

Executive Summary:
A critical arbitrary file upload vulnerability in Feng Office 3.11.13.11 allows unauthenticated remote attackers to execute malicious files, posing a severe risk of complete system compromise.

Vulnerability Details

CVE-ID: CVE-2026-36669

Affected Software: Feng Office

Affected Versions: 3.11.13.11

Vulnerability: This is an unauthenticated arbitrary file upload vulnerability located in the ck_upload_handler.php script. Attackers can bypass authentication to upload arbitrary files, such as HTML or script files, into the web-accessible /tmp/ directory, which may lead to remote code execution.

Business Impact

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation allows an unauthenticated attacker to gain unauthorized access to the web server, potentially leading to full system compromise, data theft, and the hosting of malicious content on the affected infrastructure.

Remediation Plan

Immediate Action: As no specific patch version is currently confirmed, administrators should restrict network access to the /tmp/ directory and the ck_upload_handler.php file, or disable the affected upload functionality until a vendor patch is released.

Proactive Monitoring: Review web server access logs for requests targeting ck_upload_handler.php, particularly those originating from unknown or unauthorized IP addresses, and monitor the /tmp/ directory for unexpected file creations.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the ck_upload_handler.php endpoint and inspect incoming POST requests for suspicious file extensions or content types.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub repository provided by the CVE enrichment data.

Analyst Notes: As of July 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so the exploitation risk should be treated as credible. The ability to upload files to a web-accessible directory without authentication makes this vulnerability highly susceptible to automated exploitation.

Analyst Recommendation

Given the critical nature of this vulnerability and the existence of a public proof-of-concept, organizations using Feng Office 3.11.13.11 must prioritize the immediate implementation of compensating controls. Monitor for vendor security bulletins closely to apply the necessary security update the moment it becomes available to prevent potential unauthorized access.

---METADATA---
VENDOR: WordPress
PRODUCT: wpForo Forum Plugin
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to and including 2.

Executive Summary:
An arbitrary file deletion vulnerability in the wpForo Forum WordPress plugin could allow unauthorized removal of critical system files.

Vulnerability Details

CVE-ID: CVE-2026-3666

Affected Software: WordPress wpForo Forum Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin contains a vulnerability that allows for arbitrary file deletion. This can lead to service instability or the deletion of critical configuration files, depending on the attacker's ability to interact with the plugin's functionality.

Business Impact

With a CVSS score of 8.8, this is a high-risk vulnerability. An attacker could potentially disrupt business operations by deleting essential files, leading to site downtime or the removal of security-critical configuration files that could facilitate further system compromise.

Remediation Plan

Immediate Action: Update the wpForo Forum plugin to the latest version immediately to resolve the file deletion flaw.

Proactive Monitoring: Monitor file system integrity and review WordPress logs for unusual activity related to the plugin.

Compensating Controls: Remove the plugin if it is not strictly necessary for business operations, and ensure that the WordPress installation is running with restricted file system permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe and requires immediate remediation. Organizations should update the plugin as soon as a patch is confirmed available by the developer or remove the plugin to eliminate the risk entirely.

---METADATA---
VENDOR: Mercusys
PRODUCT: AC12G (EU) V1 Router
AFFECTED_VERSIONS: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909
---END_METADATA---

Description Summary:
The Mercusys AC12G router allows UPnP AddPortMapping to forward external traffic to the router's own administrative interface, exposing it to unauthorized access.

Executive Summary:
A critical vulnerability in the Mercusys AC12G router’s UPnP implementation allows attackers to expose the device's internal administrative interface to the internet, creating a significant risk of unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-36608

Affected Software: Mercusys AC12G (EU) V1 Router

Affected Versions: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909

Vulnerability: The router's UPnP service improperly validates AddPortMapping requests, allowing an attacker to map external ports to the router's internal administrative interface. This effectively bypasses network segmentation by making the admin panel accessible from outside the local network.

Business Impact

With a CVSS score of 8.8, this flaw is highly critical as it directly exposes administrative controls to external actors. Successful exploitation allows for unauthorized management of the router, potentially resulting in full device control, credential theft, or the interception of sensitive network traffic.

Remediation Plan

Immediate Action: Disable the UPnP feature on the router immediately if it is not strictly required for network operations.

Proactive Monitoring: Audit current port forwarding rules and UPnP mappings to ensure no unintended services or administrative interfaces are exposed to the WAN.

Compensating Controls: Implement a firewall rule to block all inbound traffic to the router's administrative port from external sources, regardless of UPnP settings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Exposing administrative interfaces to the internet is a severe security failure. Organizations should disable UPnP functionality immediately and verify that no management interfaces are accessible from external networks to mitigate the risk of unauthorized exploitation.

---METADATA---
VENDOR: Mercusys
PRODUCT: AC12G (EU) V1 Router
AFFECTED_VERSIONS: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909
---END_METADATA---

Description Summary:
The Mercusys AC12G router contains an unauthenticated brute-force vulnerability in the TDDP password change endpoint due to a lack of rate limiting.

Executive Summary:
An unauthenticated brute-force vulnerability in the Mercusys AC12G router firmware allows attackers to bypass password change protections, posing a significant risk of unauthorized device takeover.

Vulnerability Details

CVE-ID: CVE-2026-36607

Affected Software: Mercusys AC12G (EU) V1 Router

Affected Versions: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909

Vulnerability: This vulnerability resides in the TDDP password change endpoint (code=10), which fails to implement the rate limiting found on the standard login endpoint. An attacker on the adjacent network can perform unlimited password guessing attempts without triggering account lockout mechanisms.

Business Impact

With a CVSS score of 8.8, this high-severity vulnerability could lead to a complete compromise of the router. Successful exploitation grants an attacker full control over the network traffic, potentially leading to unauthorized data interception, device reconfiguration, and lateral movement into the local network.

Remediation Plan

Immediate Action: Consult the vendor security advisory at https://www.mercusys.com/en/support/security-advisory to identify and apply the latest firmware updates.

Proactive Monitoring: Review router access logs for high-frequency requests to the TDDP endpoint originating from internal or adjacent network IP addresses.

Compensating Controls: Restrict management access to the router to trusted administrative IP addresses only, and isolate the management interface from the public-facing or guest network segments.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The absence of rate limiting on critical administrative endpoints represents a significant security oversight. Administrators should prioritize updating the firmware immediately to eliminate the brute-force vector and secure the device against unauthorized access.

---METADATA---
VENDOR: IBM
PRODUCT: Engineering Lifecycle Management
AFFECTED_VERSIONS: IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0
---END_METADATA---

Description Summary:
IBM Engineering Lifecycle Management allows unauthenticated remote attackers to update server property files, potentially resulting in unauthorized access.

Executive Summary:
A critical vulnerability in IBM Engineering Lifecycle Management permits unauthenticated attackers to modify server configurations, leading to unauthorized application access.

Vulnerability Details

CVE-ID: CVE-2026-3660

Affected Software: IBM Engineering Lifecycle Management

Affected Versions: IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0

Vulnerability: An unauthenticated remote attacker can exploit this vulnerability to update server property files, which facilitates unauthorized access to the application.

Business Impact

By enabling unauthorized access, this vulnerability compromises the integrity and confidentiality of the Engineering Lifecycle Management platform. With a CVSS score of 9.8, the risk of data exposure or administrative takeover of the platform is severe, potentially disrupting critical engineering workflows.

Remediation Plan

Immediate Action: Update IBM Engineering Lifecycle Management to the latest version as provided by the vendor.

Proactive Monitoring: Review file integrity logs for unauthorized modifications to server property files and monitor application access logs for suspicious administrative activity.

Compensating Controls: Ensure the application is not directly exposed to the public internet and restrict management access to authorized internal networks.

Exploitation Status

Public Exploit Available: Null

Analyst Notes: As of May 26, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should check for vendor security bulletins and apply the necessary patches immediately to prevent unauthorized access. Securing the configuration files and limiting network exposure are vital steps in mitigating this critical risk.

---METADATA---
VENDOR: EMQ
PRODUCT: NanoMQ
AFFECTED_VERSIONS: 0.24.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A memory leak vulnerability in EMQ NanoMQ version 0.24.9 allows a remote attacker to trigger a denial of service via the nni_qos_db_set function.

Executive Summary:
A high severity memory leak in EMQ NanoMQ version 0.24.9 allows remote attackers to cause a denial of service through improper resource management.

Vulnerability Details

CVE-ID: CVE-2026-36590

Affected Software: EMQ NanoMQ

Affected Versions: 0.24.9

Vulnerability: The nni_qos_db_set function in the broker_tcp.c component fails to properly manage memory, allowing a remote attacker to exhaust system resources and crash the broker.

Business Impact

The vulnerability carries a CVSS score of 7.5, justifying its high severity. Successful exploitation results in a denial of service, which can cause significant downtime for applications relying on the NanoMQ broker for message transport.

Remediation Plan

Immediate Action: Monitor official vendor communication for a patch release. In the absence of a patch, implement rate limiting on connections to the broker to slow down potential resource exhaustion.

Proactive Monitoring: Monitor system memory usage and broker health metrics for signs of rapid degradation or unexplained consumption.

Compensating Controls: Utilize a firewall to limit incoming connections to the broker from known, trusted IP addresses to reduce the likelihood of remote exploitation.

Exploitation Status

Public Exploit Available: Yes (a proof of concept is available via a public GitHub repository).

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to remote attackers due to the nature of the affected service.

Analyst Recommendation

The availability of a public proof of concept increases the risk of exploitation. Administrators should isolate the broker from public-facing networks and monitor system resources closely until an official patch is applied.

---METADATA---
VENDOR: Croixhaug
PRODUCT: Simply Schedule Appointments Booking Plugin
AFFECTED_VERSIONS: 0 through 1.6.10.0
CONFIDENCE: high
MISSING: patch
CREDITS: momopon1415 (finder)
SOURCES_JSON: [{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67c7b9b2-e73f-47fe-aecc-14e998a607c8?source=cve","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/lib/td-util/class-td-db-model.php#L1171","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/lib/td-util/class-td-api-model.php#L140","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-type-model.php#L907","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3485143/","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.183Z
---END_METADATA---

Description Summary:
The Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to unauthenticated SQL injection via the fields parameter, allowing for unauthorized database information extraction.

Executive Summary:
A critical SQL injection vulnerability in the Simply Schedule Appointments Booking Plugin for WordPress allows unauthenticated attackers to exfiltrate sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-3658

Affected Software: Croixhaug Simply Schedule Appointments Booking Plugin

Affected Versions: 0 through 1.6.10.0

Vulnerability: This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89) affecting the fields parameter. It allows unauthenticated attackers to manipulate existing SQL queries to extract sensitive data such as usernames, email addresses, and password hashes.

Business Impact

The ability for an unauthenticated attacker to extract sensitive user information poses a significant risk to data confidentiality and regulatory compliance. With a CVSS score of 7.5, this high-severity flaw could lead to full account takeovers or the compromise of administrative credentials. Such a breach typically results in severe reputational damage and potential legal liabilities regarding data protection standards.

Remediation Plan

Immediate Action: Administrators should immediately audit the installation and remove the plugin if it is not business critical. If the plugin is required, monitor for vendor updates that address the identified flaw in the class-td-db-model.php file.

Proactive Monitoring: Review database query logs for suspicious patterns or unexpected syntax involving the fields parameter. Alerting should be configured for unusual database access requests originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection attempts targeting WordPress plugins. This can provide a necessary layer of protection while awaiting a permanent software patch.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of March 20, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication, which makes the attack surface significantly broader for potential adversaries.

Analyst Recommendation

Given the high CVSS score and the sensitive nature of the data exposed, organizations must prioritize the mitigation of this vulnerability. If an official patch is not yet available, the safest course of action is to disable or remove the plugin from the environment to prevent unauthorized data access. Security teams should remain vigilant for vendor-provided updates and apply them as soon as they are released to restore the security posture of the WordPress instance.

---METADATA---
VENDOR: Openlabs
PRODUCT: docker-wkhtmltopdf-aas
AFFECTED_VERSIONS: All versions up to and including commit 9f50579.
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the app.py component allows unauthenticated attackers to execute arbitrary commands via a crafted POST request.

Executive Summary:
A critical OS command injection vulnerability in openlabs docker-wkhtmltopdf-aas exposes systems to full remote code execution by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2026-36576

Affected Software: Openlabs docker-wkhtmltopdf-aas

Affected Versions: All versions up to and including commit 9f50579.

Vulnerability: This is a command injection flaw (CWE-78) located in the app.py component. An unauthenticated attacker can exploit this by submitting a specially crafted POST request, which fails to properly neutralize special elements used in OS commands, resulting in arbitrary code execution.

Business Impact

The CVSS score of 9.8 confirms the extreme severity of this vulnerability. Successful exploitation permits an attacker to gain full control over the underlying host system, leading to total data compromise, lateral movement within the network, and potential disruption of critical business services.

Remediation Plan

Immediate Action: Upgrade to the latest version of docker-wkhtmltopdf-aas to ensure the vulnerable app.py component is patched.

Proactive Monitoring: Inspect application and system logs for suspicious POST requests containing shell metacharacters or unexpected system commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common command injection patterns in HTTP request bodies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of command injection vulnerabilities, organizations must prioritize patching this component. Ensure that any instance of docker-wkhtmltopdf-aas is updated immediately to prevent potential remote compromise of the server infrastructure.

---METADATA---
VENDOR: WordPress
PRODUCT: OTP Login With Phone Number, OTP Verification Plugin
AFFECTED_VERSIONS: versions 1.8.50 through 1.8.60
---END_METADATA---

Description Summary:
The OTP Login With Phone Number plugin for WordPress is vulnerable to authentication bypass, allowing unauthenticated attackers to hijack user accounts by exploiting a flawed Firebase verification flow.

Executive Summary:
A critical authentication bypass flaw in the WordPress OTP Login plugin allows unauthenticated attackers to gain administrative access to sites by hijacking legitimate Firebase sessions.

Vulnerability Details

CVE-ID: CVE-2026-3655

Affected Software: WordPress OTP Login With Phone Number, OTP Verification Plugin

Affected Versions: versions 1.8.50 through 1.8.60

Vulnerability: The vulnerability exists in the lwp_ajax_register AJAX handler, where the Firebase session is not correctly bound to the user's phone number. An unauthenticated attacker can verify their own Firebase session but supply a victim's phone number in the request, causing the application to incorrectly authenticate the attacker as that user.

Business Impact

The CVSS score of 9.8 reflects the high risk of account takeover. If an attacker targets an administrator's account, they can gain full control over the WordPress site, leading to complete data loss, site defacement, or the injection of malicious code into the site's front end.

Remediation Plan

Immediate Action: Immediately update the "OTP Login With Phone Number, OTP Verification" plugin to the latest available version provided by the vendor.

Proactive Monitoring: Review WordPress user account logs for suspicious logins, particularly those involving administrative accounts, and monitor for unauthorized changes to user metadata.

Compensating Controls: Temporarily disable the plugin if an update is not immediately available, or implement a secondary authentication factor (MFA) that is not tied to the vulnerable OTP verification flow.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability to bypass authentication for administrative accounts makes this a high-priority risk.

Analyst Recommendation

Given that this vulnerability allows for trivial account takeover including administrative accounts, organizations should treat this update as a high priority. Ensure all WordPress sites utilizing this plugin are updated immediately to mitigate the risk of unauthorized access.