Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
99 results · page 1 of 2
Oct 29, 2026Fiber is an Express inspired web framework written in Go.CVE-2026-119285 · Other software · gofiber · reported by GitHubMedium 5.9
Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via thCVE-2026-78801 · Other software · reported by MITREMedium 4.3
An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsk-wr6640x.comskyworth.com
Oct 13, 2026An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.CVE-2026-78802 · Other software · reported by MITRECritical 9.8
An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comskyworthdigital.com
Jul 8, 2026Fiber is an Express inspired web framework written in Go.CVE-2026-53624 · Other software · gofiber · reported by GitHubMedium 4.8
Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Fiber is an Express inspired web framework written in Go.CVE-2026-45045 · Other software · gofiber · reported by GitHubMedium 5.3
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026Fiber is an Express inspired web framework written in Go.CVE-2026-44332 · Other software · gofiber · reported by GitHubMedium 5.3
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Fiber is a web framework for Go.CVE-2026-42554 · Other software · gofiber · reported by GitHubMedium 5.3
Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. The developer opts into content negotiation by calling AutoFormat(), but does not opt into raw HTML emission for a particular request; Fiber chooses that branch from attacker-controlled Accept. The html branch is the sole outlier in a method whose name (AutoFormat) and symmetrical structure actively telegraph "safe, format-agnostic reply." This vulnerability is fixed in 2.52.12 and 3.1.0.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026Fiber is a web framework for Go.CVE-2026-30246 · Other software · gofiber · reported by GitHubMedium 6.5
Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key and receive the wrong cached response. This can cause response mix-up for query-dependent endpoints and may expose data intended for a different request. This issue is fixed after version 3.1.0.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Fiber is an Express inspired web framework written in Go.CVE-2026-25899 · Other software · gofiber · reported by GitHubHigh 7.5
Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages. Version 3.1.0 fixes the issue.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Fiber is an Express inspired web framework written in Go.CVE-2026-25891 · Other software · gofiber · reported by GitHubHigh 7.7
Fiber is an Express inspired web framework written in Go. A Path Traversal (CWE-22) vulnerability in Fiber allows a remote attacker to bypass the static middleware sanitizer and read arbitrary files on the server file system on Windows. This affects Fiber v3 through version 3.0.0. This has been patched in Fiber v3 version 3.1.0.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026Fiber is an Express inspired web framework written in Go.CVE-2026-25882 · Other software · gofiber · reported by GitHubMedium 5.5
Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Fiber is an Express inspired web framework written in Go.CVE-2025-66630 · Other software · gofiber · reported by GitHubCritical 9.2
Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an adminisCVE-2025-67014 · Other software · Axing · reported by MITREHigh 7.5
Incorrect access control in DEV Systemtechnik GmbH DEV 7113 RF over Fiber Distribution System 32-0078 H.01 allows unauthenticated attackers to access an administrative endpoint.
- Product
- Dev7113 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev-systemtechnik.comgithub.com
Dec 9, 2025Fiber Utils is a collection of common functions created for Fiber.CVE-2025-66565 · Other software · gofiber · reported by GitHubCritical 9.3
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.
- Product
- utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('webCVE-2021-4464 · Other software · FiberHome · reported by VulnCheckCritical 9.3
FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('webs') fails to enforce maximum lengths for Cookie header values. When a cookie longer than 511 bytes is processed, a stack buffer is overrun, leading to a crash or potential control of execution flow.
- Product
- AN5506-04-FA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Nov 12, 2025A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSIDCVE-2025-63353 · Other software · Fiberhome · reported by MITRECritical 9.8
A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an attacker who can observe the SSID to predict the default password without authentication or user interaction.
- Product
- Hg6145f1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Fiber is an Express inspired web framework written in Go.CVE-2025-54801 · Other software · gofiber · reported by GitHubHigh 8.7
Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2025Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticatedCVE-2025-52357 · Other software · reported by MITREMedium 4.1
Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticated attacker to execute arbitrary JavaScript code in the context of the router s web interface. The vulnerability is triggered via user-supplied input in the ping form field, which fails to sanitize special characters. This can be exploited to hijack sessions or escalate privileges through social engineering or browser-based attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Fiber is an Express-inspired web framework written in Go.CVE-2025-48075 · Other software · gofiber · reported by GitHubHigh 7.7
Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1616 · Other software · FiberHome · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this issue is some unknown functionality of the component Diagnosis. The manipulation of the argument Destination Address leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1615 · Other software · FiberHome · reported by VulDBMedium 4.8
A vulnerability classified as problematic was found in FiberHome AN5506-01A ONU GPON RP2511. Affected by this vulnerability is an unknown functionality of the component NAT Submenu. The manipulation of the argument Description leads to cross site scripting. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1614 · Other software · FiberHome · reported by VulDBMedium 4.8
A vulnerability classified as problematic has been found in FiberHome AN5506-01A ONU GPON RP2511. Affected is an unknown function of the file /goform/portForwardingCfg of the component Port Forwarding Submenu. The manipulation of the argument pf_Description leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability was found in FiberHome AN5506-01A ONU GPON RP2511.CVE-2025-1613 · Other software · FiberHome · reported by VulDBMedium 4.8
A vulnerability was found in FiberHome AN5506-01A ONU GPON RP2511. It has been rated as problematic. This issue affects some unknown processing of the file /goform/URL_filterCfg of the component URL Filtering Submenu. The manipulation of the argument url_IP leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AN5506-01A ONU GPON
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025A vulnerability was found in Bharti Airtel Xstream Fiber up to 20250123.CVE-2025-1081 · Other software · Bharti Airtel · reported by VulDBLow 2.3
A vulnerability was found in Bharti Airtel Xstream Fiber up to 20250123. It has been rated as problematic. This issue affects some unknown processing of the component WiFi Password Handler. The manipulation leads to use of weak credentials. The attack needs to be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Xstream Fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsvuldb.com
Nov 8, 2024In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83869: fix memory corruption when enabling fiber When configuring the fiber poCVE-2024-50188 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83869: fix memory corruption when enabling fiber When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure. Since the advertising flags are updated from supported at the end of the function the incorrect line isn't needed at all and can be removed.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 1, 2024Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI Clients List not beinCVE-2024-51432 · Other software · fiberhome · reported by MITREMedium 4.8
Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI Clients List not being sanitized
- Product
- hg6544c_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.fiberhome.comgithub.com
Jul 1, 2024Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2CVE-2024-38513 · Other software · gofiber · reported by GitHubCritical 10
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in version 2.52.5. Users are strongly encouraged to upgrade to version 2.52.5 or higher to mitigate this vulnerability. Users who are unable to upgrade immediately can apply the following workarounds to reduce the risk: Either implement additional validation to ensure session IDs are not supplied by the user and are securely generated by the server, or regularly rotate session IDs and enforce strict session expiration policies.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2024A vulnerability was found in Genexis Tilgin Fiber Home Gateway HG1522 CSx000-01_09_01_12.CVE-2024-6355 · Other software · Genexis · reported by VulDBMedium 6.9
A vulnerability was found in Genexis Tilgin Fiber Home Gateway HG1522 CSx000-01_09_01_12. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /status/product_info/. The manipulation of the argument product_info leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269755. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Tilgin Fiber Home Gateway HG1522
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024Fiber is a web framework written in go.CVE-2024-25124 · Other software · gofiber · reported by GitHubCritical 9.4
Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard (`*`) while also having the Access-Control-Allow-Credentials set to true, which goes against recommended security best practices. The impact of this misconfiguration is high as it can lead to unauthorized access to sensitive user data and expose the system to various types of attacks listed in the PortSwigger article linked in the references. Version 2.52.1 contains a patch for this issue. As a workaround, users may manually validate the CORS configurations in their implementation to ensure that they do not allow a wildcard origin when credentials are enabled. The browser fetch api, as well as browsers and utilities that enforce CORS policies, are not affected by this.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.portswigger.netcodeql.github.com
Jan 11, 2024This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface.CVE-2024-22199 · Other software · gofiber · reported by GitHubCritical 9.3
This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.
- Product
- template
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Fiber is an express inspired web framework written in Go.CVE-2023-45141 · Other software · gofiber · reported by GitHubHigh 8.6
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This vulnerability has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023Fiber is an express inspired web framework written in Go.CVE-2023-45128 · Other software · gofiber · reported by GitHubCritical 10
Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allows an attacker to inject arbitrary values and forge malicious requests on behalf of a user. This vulnerability can allow an attacker to inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated user, potentially compromising the security and integrity of the application. The vulnerability is caused by improper validation and enforcement of CSRF tokens within the application. This issue has been addressed in version 2.50.0 and users are advised to upgrade. Users should take additional security measures like captchas or Two-Factor Authentication (2FA) and set Session cookies with SameSite=Lax or SameSite=Secure, and the Secure and HttpOnly attributes as defense in depth measures. There are no known workarounds for this vulnerability.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2023Fiber is an Express inspired web framework built in the go language.CVE-2023-41338 · Other software · gofiber · reported by GitHubMedium 5.3
Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. Setting `X-Forwarded-For: 127.0.0.1` in a request from a foreign host, will result in true for `ctx.IsFromLocal`. Access is limited to the scope of the affected process. This issue has been patched in version `2.49.2` with commit `b8c9ede6`. Users are advised to upgrade. There are no known workarounds to remediate this vulnerability without upgrading to the patched version.
- Product
- fiber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orgdocs.gofiber.io
May 23, 2023An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14_X000 was found via the /boaform/admin/formPing target_addr parameter.CVE-2023-33617 · Other software · Eparks · reported by MITREHigh 7.2
An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14_X000 was found via the /boaform/admin/formPing target_addr parameter.
- Product
- Fiberlink 210 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 2, 2023The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and CVE-2023-23119 · Other software · UI · reported by MITREMedium 5.9
The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.
- Product
- Af-2x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comhackmd.io
Dec 25, 2022Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and /boaform/formTraCVE-2022-40005 · Other software · Intelbras · reported by MITREHigh 8.8
Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and /boaform/formTracert URIs for ping and traceroute.
- Product
- Wifiber 120ac Inmesh Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcyberdanube.comseclists.org
Dec 23, 2022An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <1.4.1 that allows a CVE-2022-44565 · Other software · UI · reported by support@hackerone.comMedium 5.3
An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <1.4.1 that allows a malicious actor to retrieve status and usage data from the UISP device.
- Product
- Airfiber Gigabeam Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.ui.comcommunity.ui.com
Sep 15, 2022A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scriCVE-2022-38814 · Other software · Fiberhome · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfg_loid text field.
- Product
- An5506-02-b Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Aug 29, 2022In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.CVE-2022-36200 · Other software · Fiberhome · reported by MITREHigh 7.5
In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.
- Product
- Hg150-ub Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a CVE-2021-41946 · Other software · Fiberhome · reported by MITREMedium 5.4
In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a user cannot delete the rule due to the XSS.
- Product
- Hg150-ub Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiberhome.comgithub.com
Dec 16, 2021FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability.CVE-2021-42912 · Other software · Fiberhome · reported by MITREHigh 8.8
FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.
- Product
- An5506-01-a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2021Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard oCVE-2020-28695 · Other software · Askey · reported by MITREHigh 8.8
Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root.
- Product
- Rtf3505vw-n1 BR SV G000 R3505vwn1001 S32 7 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcr1pt0.medium.comcr1pt0.medium.com
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27179 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to crash the telnet daemon by sending a certain 0a 65 6e 61 62 6c 65 0a 02 0a 1a 0a string.
- Product
- Hg6245d Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27178 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram.
- Product
- Hg6245d Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27177 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending the decoded value of the GgpoZWxwCmxpc3QKd2hvCg== string to the telnet server.
- Product
- Hg6245d Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27176 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_5g.cfg has cleartext passwords and 0644 permissions.
- Product
- Hg6245d Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27175 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_2g.cfg has cleartext passwords and 0644 permissions.
- Product
- Hg6245d Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27174 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. wifi_custom.cfg has cleartext passwords and 0644 permissions.
- Product
- Hg6245d Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27173 · Other software · Fiberhome · reported by MITREHigh 7.5
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a telnet?enable=0&key=calculated(BR0_MAC) backdoor API, without authentication, provided by the HTTP server. This will remove firewall rules and allow an attacker to reach the telnet server (used for the CLI).
- Product
- Hg6245d Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Feb 10, 2021An issue was discovered on FiberHome HG6245D devices through RP2613.CVE-2021-27172 · Other software · Fiberhome · reported by MITRECritical 9.8
An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh.
- Product
- Hg6245d Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpierrekim.github.iopierrekim.github.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.