https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 08:42:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-262234 EUVD-2026-262234 https://cve.radiocsirt.org/vuln/euvd-2026-262234 https://cve.radiocsirt.org/vuln/fkie_cve-2025-11786 <p>Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the &#39;SetUserPassword()&#39; function, the &#39;newPassword&#39; parameter is directly embedded in a shell command string using &#39;sprintf()&#39; without any sanitisation or validation, and then executed using &#39;system()&#39;. This allows an attacker to inject arbitrary shell commands that will be executed with the same privileges as the application.</p> <p>Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the &#39;SetUserPassword()&#39; function, the &#39;newPassword&#39; parameter is directly embedded in a shell command string using &#39;sprintf()&#39; without any sanitisation or validation, and then executed using &#39;system()&#39;. This allows an attacker to inject arbitrary shell commands that will be executed with the same privileges as the application.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-11786 https://cve.radiocsirt.org/vuln/ghsa-7wvg-7hg7-gfph <p>Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the &#39;SetUserPassword()&#39; function, the &#39;newPassword&#39; parameter is directly embedded in a shell command string using &#39;sprintf()&#39; without any sanitisation or validation, and then executed using &#39;system()&#39;. This allows an attacker to inject arbitrary shell commands that will be executed with the same privileges as the application.</p> <p>Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the &#39;SetUserPassword()&#39; function, the &#39;newPassword&#39; parameter is directly embedded in a shell command string using &#39;sprintf()&#39; without any sanitisation or validation, and then executed using &#39;system()&#39;. This allows an attacker to inject arbitrary shell commands that will be executed with the same privileges as the application.</p> https://cve.radiocsirt.org/vuln/ghsa-7wvg-7hg7-gfph