Total
398160 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-28033 | 1 Totolink | 12 A3000ru, A3000ru Firmware, A3100r and 9 more | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through the IpTo parameter. | |||||
| CVE-2025-28032 | 1 Totolink | 12 A3000ru, A3000ru Firmware, A3100r and 9 more | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through the IpForm parameter. | |||||
| CVE-2025-28031 | 1 Totolink | 1 A810r Firmware | 2026-06-17 | N/A | 6.5 MEDIUM |
| TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for the telnet service in product.ini. | |||||
| CVE-2025-28030 | 1 Totolink | 2 A810r, A810r Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a stack overflow via the startTime and endTime parameters in setParentalRules function. | |||||
| CVE-2025-28029 | 1 Totolink | 8 A3000ru, A3000ru Firmware, A3100r and 5 more | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in cstecgi.cgi | |||||
| CVE-2025-28028 | 1 Totolink | 8 A3000ru, A3000ru Firmware, A3100r and 5 more | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v5 parameter. | |||||
| CVE-2025-28027 | 1 Totolink | 8 A3000ru, A3000ru Firmware, A3100r and 5 more | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a buffer overflow vulnerability in downloadFile.cgi. | |||||
| CVE-2025-28026 | 1 Totolink | 8 A3000ru, A3000ru Firmware, A3100r and 5 more | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi. | |||||
| CVE-2025-28025 | 1 Totolink | 8 A3000ru, A3000ru Firmware, A3100r and 5 more | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter. | |||||
| CVE-2025-28024 | 1 Totolink | 2 A810r, A810r Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi | |||||
| CVE-2025-28022 | 1 Totolink | 2 A810r, A810r Firmware | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter. | |||||
| CVE-2025-28021 | 1 Totolink | 2 A810r, A810r Firmware | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the downloadFile.cgi through the v14 and v3 parameters | |||||
| CVE-2025-28020 | 1 Totolink | 2 A800r, A800r Firmware | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter. | |||||
| CVE-2025-28019 | 1 Totolink | 2 A800r, A800r Firmware | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi component | |||||
| CVE-2025-28018 | 1 Totolink | 2 A800r, A800r Firmware | 2026-06-17 | N/A | 7.3 HIGH |
| TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter. | |||||
| CVE-2025-28017 | 1 Totolink | 2 A800r, A800r Firmware | 2026-06-17 | N/A | 6.5 MEDIUM |
| TOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via the QUERY_STRING parameter. | |||||
| CVE-2025-28016 | 1 Phpgurukul | 1 User Registration \& Login And User Management System | 2026-06-17 | N/A | 4.8 MEDIUM |
| A Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary JavaScript code via the fname, lname, and contact parameters. | |||||
| CVE-2025-28015 | 1 Phpgurukul | 1 User Registration \& Login And User Management System | 2026-06-17 | N/A | 5.3 MEDIUM |
| A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary HTML code via the fname, lname, and contact parameters. | |||||
| CVE-2025-28011 | 1 Phpgurukul | 1 User Registration \& Login And User Management System | 2026-06-17 | N/A | 6.1 MEDIUM |
| A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows remote attackers to execute arbitrary code via the currentpassword POST request parameter. | |||||
| CVE-2025-28010 | 1 Modx | 1 Modx | 2026-06-17 | N/A | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image. | |||||