Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,466 results · page 13 of 30
Jun 3, 2025A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011.CVE-2025-5508 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been rated as problematic. Affected by this issue is some unknown functionality of the component IP Port Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- A3002RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011.CVE-2025-5507 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component MAC Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- A3002RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011.CVE-2025-5506 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been classified as problematic. Affected is an unknown function of the component NAT Mapping Page. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- A3002RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 and classified as problematic.CVE-2025-5505 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 and classified as problematic. This issue affects some unknown processing of the file /boafrm/formPortFw of the component Virtual Server Page. The manipulation of the argument service_type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- A3002RU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical.CVE-2025-5504 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWsc. The manipulation of the argument peerRptPin leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X2000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-5503 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105. This affects the function formMapReboot of the file /boafrm/formMapReboot. The manipulation of the argument deviceMacAddr leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20230714.1105.CVE-2025-5502 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this issue is the function formMapReboot of the file /boafrm/formMapReboot. The manipulation of the argument deviceMacAddr leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X15
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the interfacenameds parameter in the formDhcpv6s interface.CVE-2025-45862 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the interfacenameds parameter in the formDhcpv6s interface.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 18, 2025A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011.CVE-2025-4852 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the component VPN Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2025A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101.CVE-2025-4851 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N300RH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101.CVE-2025-4850 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- N300RH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101.CVE-2025-4849 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability was found in TOTOLINK N300RH 6.1c.1390_B20191101. It has been rated as critical. Affected by this issue is the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument url leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- N300RH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4835 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formWlanRedirect of the component HTTP POST Request Handler. The manipulation of the argument redirect-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4834 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been classified as critical. Affected is an unknown function of the file /boafrm/formSetLg of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 and classified as critical.CVE-2025-4833 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 and classified as critical. This issue affects some unknown processing of the file /boafrm/formNtp of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 and classified as critical.CVE-2025-4832 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formDosCfg of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4831 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formSiteSurveyProfile of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4830 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. Affected by this issue is some unknown functionality of the file /boafrm/formSysCmd of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4829 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. Affected by this vulnerability is the function sub_40BE30 of the file /boafrm/formStats of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4827 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. Affected is an unknown function of the file /boafrm/formSaveConfig of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4826 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects some unknown processing of the file /boafrm/formWirelessTbl of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4825 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formDMZ of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability classified as critical has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4824 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2025A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4823 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is the function submit-url of the file /boafrm/formReflashClientTbl of the component HTTP POST Request Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4733 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This issue affects some unknown processing of the file /boafrm/formIpQoS of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4732 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4731 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument service_type/ip_subnet leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4730 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615.CVE-2025-4729 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A3002R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the macstr parameter in the formMapDelDevice interface.CVE-2025-45863 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the macstr parameter in the formMapDelDevice interface.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 13, 2025TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the dnsaddr parameter in the formDhcpv6s interface.CVE-2025-45865 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the dnsaddr parameter in the formDhcpv6s interface.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 13, 2025TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the routername parameter in the formDnsv6 interface.CVE-2025-45861 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the routername parameter in the formDnsv6 interface.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 13, 2025TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function.CVE-2025-45858 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability via the FUN_00459fdc function.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 13, 2025TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the static_dns1 parameter in the formIpv6Setup interface.CVE-2025-45867 · Other software · Totolink · reported by MITREMedium 5.4
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the static_dns1 parameter in the formIpv6Setup interface.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 13, 2025TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolEnd parameter in the formDhcpv6s interface.CVE-2025-45866 · Other software · Totolink · reported by MITREMedium 5.4
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolEnd parameter in the formDhcpv6s interface.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 13, 2025TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolStart parameter in the formDhcpv6s interface.CVE-2025-45864 · Other software · Totolink · reported by MITREMedium 5.4
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the addrPoolStart parameter in the formDhcpv6s interface.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 13, 2025TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the bandstr parameter in the formMapDelDevice interface.CVE-2025-45859 · Other software · Totolink · reported by MITREMedium 5.4
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow via the bandstr parameter in the formMapDelDevice interface.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 10, 2025A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927.CVE-2025-4496 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- T10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-4462 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-4461 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-4460 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the component URL Filtering Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112.CVE-2025-45798 · Other software · Totolink · reported by MITRECritical 9.8
A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in the setNoticeCfg interface within the /lib/cste_modules/system.so library, specifically in the processing of the IpTo parameter.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability.CVE-2025-45797 · Other software · Totolink · reported by MITRECritical 9.8
TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the NoticeUrl parameter in the setNoticeCfg interface of /lib/cste_modules/system.so.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the priority parameter in the setMacQos interface of /lib/cste_modules/firewall.so.CVE-2025-45790 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the priority parameter in the setMacQos interface of /lib/cste_modules/firewall.so.
- Product
- A3100r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules.CVE-2025-45789 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules.
- Product
- A3100r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the comment parameter in setMacFilterRules.CVE-2025-45788 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the comment parameter in setMacFilterRules.
- Product
- A3100r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow viathe comment parameter in setIpPortFilterRules.CVE-2025-45787 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow viathe comment parameter in setIpPortFilterRules.
- Product
- A3100r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2025TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyGuestCfg function.CVE-2025-45845 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyGuestCfg function.
- Product
- Nr1800x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 8, 2025TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiBasicCfg function.CVE-2025-45844 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiBasicCfg function.
- Product
- Nr1800x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 8, 2025TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiGuestCfg function.CVE-2025-45843 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the setWiFiGuestCfg function.
- Product
- Nr1800x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.