Reserved but Public CVEs

CVE-2021-35403 is an unauthenticated OS command injection vulnerability in the PROLiNK PRC2402M router, observed on firmware version 20190909. The flaw is in the CGI handler /cgi-bin/touchlist_sync.cgi, where attacker-controlled input from the IP query parameter is incorporated into a shell command that is executed via popen without proper validation or sanitization. The vulnerable code constructs a command of the form "curl -s -m 5 http://%s/cgi-bin/touchlist_sync.cgi?getACL=1" using the supplied IP value and then executes it with popen. Because the IP parameter is not safely constrained, an attacker can inject shell metacharacters and arbitrary commands. The vulnerable path is reachable when getACL is not equal to "1" and the device NVRAM MeshMode value is set to "1" or "2".

CVE-2021-35403First seen Apr 11, 2026

CVE-2021-35407 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/mesh.cgi CGI handler, specifically the code path reached when the page parameter is set to upgrade. In that path, the get_upgrade_page function reads attacker-controlled parameters including key from the HTTP query string, retrieves lan_ipaddr from NVRAM, and constructs a shell command using sprintf with the format string "echo -n '%s' | md5sum". Because the key parameter is not properly validated or sanitized before being incorporated into the command and executed via popen, an attacker can inject shell metacharacters and execute arbitrary commands. The vulnerable endpoint is reachable over HTTP GET and does not require authentication. Successful exploitation results in arbitrary command execution as root on the affected device.

CVE-2021-35407First seen Apr 11, 2026

CVE-2021-35409 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, tested on firmware version 20190909. The flaw is in the CGI endpoint /cgi-bin/nightled.cgi. According to the provided analysis, the script reads HTTP GET parameters from QUERY_STRING and, via setNightLed, retrieves user-controlled values including start_hour, start_min, end_hour, and end_min. These values are duplicated and incorporated with sprintf into the shell command "echo -n %s %s %s %s > /tmp/scheduleSet &", which is then executed through do_system without sufficient input validation or sanitization. Because attacker-controlled input reaches a command-execution sink, a remote attacker can inject arbitrary shell metacharacters and execute commands.

CVE-2021-35409First seen Apr 11, 2026

CVE-2020-25545 affects the Askey AP5100W Wi-Fi mesh node, tested on firmware Dual_SIG_1.01.071. The device web interface exposes functionality to generate and download a configuration backup. According to the provided content, an authenticated attacker can invoke status.cgi with parameters such as service=cfgbackup and act=nvset to create a backup, then retrieve the archive from /configs/config.tar. The downloaded configuration archive contains sensitive information including the web interface administrator password, Wi-Fi password, and other configuration data. The content further states that if a configuration backup already exists, the archive may be retrievable without authentication, regardless of current login state.

CVE-2020-25545First seen Apr 11, 2026

CVE-2020-25546 affects the Askey AP5100W Wi-Fi mesh node web management interface, tested on version Dual_SIG_1.01.071. The authentication implementation is reportedly flawed such that a successful administrator login sets a device-wide authenticated state rather than establishing a per-user session. The report states that no session keys or cookies are used, and once any legitimate user logs into the web interface, subsequent requests from other parties with access to the interface are treated as authenticated. This results in an authentication bypass condition for attackers on the local network or otherwise able to reach the management interface.

CVE-2020-25546First seen Apr 11, 2026

CVE-2021-35408 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/qos.cgi CGI handler. When the page parameter is set to qos_sta, qos.cgi invokes qos_sta_settings, which reads the user-controlled cli_list and cli_num parameters and uses sprintf to construct the shell command '/sbin/sta_qos.sh setup %s %s'. That command string is then passed to system without sufficient input validation or sanitization. Because attacker-controlled input is incorporated directly into a shell command, a remote attacker can submit a crafted HTTP POST request to /cgi-bin/qos.cgi and execute arbitrary commands on the device.

CVE-2021-35408First seen Apr 11, 2026

CVE-2021-35404 is an authenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/applogin.cgi CGI handler. When the api parameter is set to app, applogin.cgi invokes sys_login1, which retrieves user-controlled parameters including ipaddr, password, and lang. After validating the supplied password against the expected MD5 value, the code constructs a shell command using sprintf and executes it via do_system, a wrapper around system. Because the ipaddr and lang parameters are incorporated into the shell command without proper validation or sanitization, an authenticated attacker can inject shell metacharacters and execute arbitrary commands. The injected commands run in the context of the root user.

CVE-2021-35404First seen Apr 11, 2026

First seen Mar 18, 2026

A reflected cross-site scripting (XSS) vulnerability exists in Invision Community software, specifically in the /oauth/callback/index.php script. The vulnerability is present in certain 4.x versions before 4.7.21 and all 5.x versions before 5.0.8. It arises due to insufficient sanitization of user input passed via the 'state' POST parameter, allowing attackers to inject and execute arbitrary JavaScript in the context of a victim's browser if they can trick the victim into submitting a crafted request.

CVE-2025-48933First seen Mar 18, 2026

First seen Oct 11, 2026

First seen Oct 11, 2026

First seen Oct 11, 2026

First seen Oct 11, 2026

First seen Oct 11, 2026

First seen Oct 11, 2026

CVE-2024-36312 is an isolation vulnerability involving an AMD VCN-JPEG hardware memory-space control register. A malicious guest virtual machine can perform an unauthorized write to the register, gaining arbitrary read and write access to physical memory belonging to the host and other guest virtual machines.

CVE-2024-36312First seen Oct 10, 2026

CVE-2024-21936 is an improper input validation vulnerability in the Satellite Management Controller (SMC) of AMD Instinct MI300X accelerators. A privileged attacker can send multiple manipulated Redfish API commands that cause service processes such as OpenBMC to crash and reset, potentially resulting in denial of service.

CVE-2024-21936First seen Oct 10, 2026

CVE-2021-46745 is an insufficient input validation vulnerability in the AMD Secure Processor (ASP) and system driver. An attacker may submit malformed structures that cause memory corruption, potentially compromising memory integrity.

CVE-2021-46745First seen Oct 10, 2026

First seen Oct 10, 2026

CVE-2024-21968 is an incorrect default permissions vulnerability in the AMD DASH CLI installation directory. When a non-default installation location is selected, inherited directory permissions may allow lower-privileged users to escalate privileges while the CLI operates with elevated privileges. Successful exploitation may result in arbitrary code execution with elevated permissions.

CVE-2024-21968First seen Oct 10, 2026

First seen Oct 9, 2026

First seen Oct 9, 2026

First seen Oct 9, 2026

First seen Oct 9, 2026

First seen Oct 9, 2026