Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
34 results
Aug 24, 2026In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.CVE-2025-26238 · Other software · reported by MITREHigh 8.1
In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A vulnerability has been found in D-Link DI-8100 16.07.26A1.CVE-2026-7857 · Network & remote access · D-Link · reported by VulDBHigh 7.3
A vulnerability has been found in D-Link DI-8100 16.07.26A1. This vulnerability affects the function sprintf of the file /user_group.asp of the component CGI Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A flaw has been found in D-Link DI-8100 16.07.26A1.CVE-2026-7856 · Network & remote access · D-Link · reported by VulDBHigh 7.3
A flaw has been found in D-Link DI-8100 16.07.26A1. This affects an unknown part of the file /url_member.asp of the component Web Management Interface. Executing a manipulation of the argument Name can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A vulnerability was detected in D-Link DI-8100 16.07.26A1.CVE-2026-7855 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the component HTTP Request Handler. Performing a manipulation of the argument Name results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A security vulnerability has been detected in D-Link DI-8100 16.07.26A1.CVE-2026-7854 · Network & remote access · D-Link · reported by VulDBHigh 8.9
A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A weakness has been identified in D-Link DI-8100 16.07.26A1.CVE-2026-7853 · Network & remote access · D-Link · reported by VulDBHigh 8.9
A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component HTTP Handler. This manipulation of the argument enable/time causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A vulnerability was identified in D-Link DI-8100 16.07.26A1.CVE-2026-7851 · Network & remote access · D-Link · reported by VulDBHigh 7.3
A vulnerability was identified in D-Link DI-8100 16.07.26A1. This affects the function sprintf of the file yyxz.asp. The manipulation of the argument ID leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability was found in D-Link DI-8100 16.07.26A1.CVE-2026-7248 · Network & remote access · D-Link · reported by VulDBHigh 8.9
A vulnerability was found in D-Link DI-8100 16.07.26A1. This affects the function tgfile_htm of the file tgfile.htm of the component CGI Endpoint. The manipulation of the argument fn results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A vulnerability has been found in D-Link DI-8100 16.07.26A1.CVE-2026-7247 · Network & remote access · D-Link · reported by VulDBHigh 7.3
A vulnerability has been found in D-Link DI-8100 16.07.26A1. Affected by this issue is the function file_exten_asp of the file file_exten.asp of the component File Extension Handler. The manipulation of the argument Name leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026D-Link DI-8003 v16.07.26A1, DI-8500 v16.07.26A1; DI-8003G v17.12.21A1, DI-8200G v17.12.20A1, DI-8200 v16.07.26A1, DI-8400 v16.07.26A1, DI-8004w v16.07.26A1, DI-CVE-2025-52222 · Other software · Dlink · reported by MITREHigh 7.5
D-Link DI-8003 v16.07.26A1, DI-8500 v16.07.26A1; DI-8003G v17.12.21A1, DI-8200G v17.12.20A1, DI-8200 v16.07.26A1, DI-8400 v16.07.26A1, DI-8004w v16.07.26A1, DI-8100 v16.07.26A1, and DI-8100G v17.12.20A1 were discovered to contain a buffer overflow via the rd_en, rd_auth, rd_acct, http_hadmin, http_hadminpwd, rd_key, and rd_ip parameters in the radius_asp function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- Di-8100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1.CVE-2025-10441 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.
- Product
- DI-8100G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1.CVE-2025-10440 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025D-Link DI-8100 16.07.26A1 is vulnerable to Buffer Overflow via the en`, `val and id parameters in the qj_asp function.CVE-2025-51281 · Other software · Dlink · reported by MITREHigh 7
D-Link DI-8100 16.07.26A1 is vulnerable to Buffer Overflow via the en`, `val and id parameters in the qj_asp function. This vulnerability allows authenticated attackers to cause a Denial of Service (DoS) by sending crafted GET requests with overly long values for these parameters.
- Product
- Di-8100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability classified as critical was found in D-Link DI-8100 1.0.CVE-2025-7911 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability classified as critical was found in D-Link DI-8100 1.0. This vulnerability affects the function sprintf of the file /upnp_ctrl.asp of the component jhttpd. The manipulation of the argument remove_ext_proto/remove_ext_port leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2025A vulnerability was found in D-Link DI-8100 1.0.CVE-2025-7908 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was found in D-Link DI-8100 1.0. It has been declared as critical. Affected by this vulnerability is the function sprintf of the file /ddns.asp?opt=add of the component jhttpd. The manipulation of the argument mx leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability was found in D-Link DI-8100 16.07.26A1.CVE-2025-7790 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. This affects an unknown part of the file /menu_nat.asp of the component HTTP Request Handler. The manipulation of the argument out_addr/in_addr/out_port/proto leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1.CVE-2025-7762 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1. This issue affects some unknown processing of the file /menu_nat_more.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability was found in D-Link DI-8100 16.07.26A1.CVE-2025-7603 · Network & remote access · D-Link · reported by VulDBHigh 7.3
A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. Affected is an unknown function of the file /jingx.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability was found in D-Link DI-8100 16.07.26A1 and classified as critical.CVE-2025-7602 · Network & remote access · D-Link · reported by VulDBHigh 7.3
A vulnerability was found in D-Link DI-8100 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /arp_sys.asp of the component HTTP Request Handler. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability was found in D-Link DI-8100 16.07.21.CVE-2025-6881 · Network & remote access · D-Link · reported by VulDBHigh 7.4
A vulnerability was found in D-Link DI-8100 16.07.21. It has been rated as critical. Affected by this issue is some unknown functionality of the file /pppoe_base.asp of the component jhttpd. The manipulation of the argument mschap_en leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025A vulnerability was found in D-Link DI-8100 up to 20250523.CVE-2025-5228 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DI-8100 up to 20250523. It has been classified as critical. Affected is the function httpd_get_parm of the file /login.cgi of the component jhttpd. The manipulation of the argument notify leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authenticationCVE-2025-44083 · Other software · Dlink · reported by MITRECritical 9.8
An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication
- Product
- Di-8100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025D-link DI-8100 16.07.26A1 is vulnerable to Command Injection.CVE-2025-44084 · Other software · Dlink · reported by MITRECritical 9.8
D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the command execution flaw and gaining the highest privilege shell access to the firmware system.
- Product
- Di-8100g Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2025A vulnerability was found in D-Link DI-8100 16.07.26A1.CVE-2025-4883 · Network & remote access · D-Link · reported by VulDBHigh 8.6
A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been declared as critical. This vulnerability affects the function ctxz_asp of the file /ctxz.asp of the component Connection Limit Page. The manipulation of the argument def/defTcp/defUdp/defIcmp/defOther leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical.CVE-2025-4544 · Network & remote access · D-Link · reported by VulDBHigh 7.5
A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /ddos.asp of the component jhttpd. The manipulation of the argument def_max/def_time/def_tcp_max/def_tcp_time/def_udp_max/def_udp_time/def_icmp_max leads to stack-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2025A vulnerability was found in D-Link DI-8100 16.07.26A1.CVE-2025-3538 · Network & remote access · D-Link · reported by VulDBHigh 8.7
A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function auth_asp of the file /auth.asp of the component jhttpd. The manipulation of the argument callback leads to stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter.CVE-2025-28398 · Other software · Dlink · reported by MITREHigh 7.1
D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter.
- Product
- Di-8100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter.CVE-2025-28395 · Other software · Dlink · reported by MITREHigh 7.1
D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter.
- Product
- Di-8100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip_position_asp function via the ip parameter.CVE-2024-52711 · Other software · dlink · reported by MITREMedium 5.7
DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip_position_asp function via the ip parameter.
- Product
- di-8100_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024D-Link DI-8100 v16.07.26A1 has a stack overflow vulnerability in the dbsrv_asp function.CVE-2024-44375 · Other software · Dlink · reported by MITREHigh 7.5
D-Link DI-8100 v16.07.26A1 has a stack overflow vulnerability in the dbsrv_asp function.
- Product
- Di-8100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2024D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.CVE-2024-44402 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.
- Product
- di-8100g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2024D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp fileCVE-2024-44401 · Network & remote access · d-link · reported by MITRECritical 9.8
D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file
- Product
- di-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2024A vulnerability was found in D-Link DI-8100 16.07.CVE-2024-7833 · Network & remote access · D-Link · reported by VulDBMedium 5.3
A vulnerability was found in D-Link DI-8100 16.07. It has been classified as critical. This affects the function upgrade_filter_asp of the file upgrade_filter.asp. The manipulation of the argument path leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2024A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.CVE-2024-7436 · Network & remote access · D-Link · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07. This issue affects the function msp_info_htm of the file msp_info.htm. The manipulation of the argument cmd leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273521 was assigned to this vulnerability.
- Product
- DI-8100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.