CVE-2024-7189

itsourcecode Online Food Ordering System editproduct.php unrestricted upload

A vulnerability classified as critical has been found in itsourcecode Online Food Ordering System 1.0. Affected is an unknown function of the file editproduct.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272610 is the identifier assigned to this vulnerability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kevinwong

Products

Online Food Ordering System

CVE-2024-7188

Bylancer Quicklancer GET Parameter listing sql injection

A vulnerability was found in Bylancer Quicklancer 2.4. It has been rated as critical. This issue affects some unknown processing of the file /listing of the component GET Parameter Handler. The manipulation of the argument range2 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272609 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS 7.0% KEV · Not listed

Vendors

Bylancer

Products

Quicklancer

CVE-2024-7187

TOTOLINK A3600R cstecgi.cgi UploadCustomModule buffer overflow

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been declared as critical. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272608. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7186

TOTOLINK A3600R cstecgi.cgi setWiFiAclAddConfig buffer overflow

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been classified as critical. This affects the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument comment leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272607. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7185

TOTOLINK A3600R cstecgi.cgi setWebWlanIdx buffer overflow

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. Affected by this issue is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument webWlanIdx leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272606 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7184

TOTOLINK A3600R cstecgi.cgi setUrlFilterRules buffer overflow

A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7183

TOTOLINK A3600R cstecgi.cgi setUploadSetting buffer overflow

A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272604. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7182

TOTOLINK A3600R cstecgi.cgi setUpgradeFW buffer overflow

A vulnerability, which was classified as critical, has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This issue affects the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272603. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7181

TOTOLINK A3600R cstecgi.cgi setTelnetCfg command injection

A vulnerability classified as critical was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument telnet_enabled leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-272602 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7180

TOTOLINK A3600R cstecgi.cgi setPortForwardRules buffer overflow

A vulnerability classified as critical has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This affects the function setPortForwardRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument comment leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272601 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7179

TOTOLINK A3600R cstecgi.cgi setParentalRules buffer overflow

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been rated as critical. Affected by this issue is the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument startTime/endTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272600. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7178

TOTOLINK A3600R cstecgi.cgi setMacQos buffer overflow

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been declared as critical. Affected by this vulnerability is the function setMacQos of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument priority/macAddress leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272599. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7177

TOTOLINK A3600R cstecgi.cgi setLanguageCfg buffer overflow

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been classified as critical. Affected is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272598 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7176

TOTOLINK A3600R cstecgi.cgi setIpQosRules buffer overflow

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. This issue affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument comment leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272597 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7175

TOTOLINK A3600R cstecgi.cgi setDiagnosisCfg os command injection

A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ipDoamin leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272596. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7174

TOTOLINK A3600R cstecgi.cgi setdeviceName buffer overflow

A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This affects the function setdeviceName of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument deviceMac/deviceName leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272595. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7173

TOTOLINK A3600R cstecgi.cgi loginauth buffer overflow

A vulnerability, which was classified as critical, has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password/http_host leads to buffer overflow. The attack may be launched remotely. VDB-272594 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7172

TOTOLINK A3600R getSaveConfig buffer overflow

A vulnerability classified as critical was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected by this vulnerability is the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The manipulation of the argument http_host leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272593 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7171

TOTOLINK A3600R cstecgi.cgi NTPSyncWithHost os command injection

A vulnerability classified as critical has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected is the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostTime leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272592. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 3.1% KEV · Not listed

Vendors

Totolink

Products

A3600r A3600r Firmware

CVE-2024-7170

TOTOLINK A3000RU product.ini hard-coded password

A vulnerability was found in TOTOLINK A3000RU 5.9c.5185. It has been rated as problematic. This issue affects some unknown processing of the file /web_cste/cgi-bin/product.ini. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272591. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

A3000ru A3000ru Firmware