Most recent entries from all

EUVD-2026-245807

fkie_cve-2025-41427

WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Connection Diagnostics page. If a remote authenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be executed.

GHSA-7pgx-3wpq-wj9f

jvndb-2025-000041

Multiple wireless LAN routers provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below. <ul> <li>Unrestricted upload of file with dangerous type (CWE-434) - CVE-2025-36519</li> <li>OS command injection in Connection Diagnostics page (CWE-78) - CVE-2025-41427</li> <li>Stored cross-site scripting in WebGUI (CWE-79) - CVE-2025-43877</li> <li>OS command injection in the telnet function (CWE-78) - CVE-2025-43879</li> <li>OS command injection in miniigd SOAP service (CWE-78) - CVE-2025-48890</li> </ul> CVE-2025-36519 Tien Phan reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. CVE-2025-41427 Yoshiki Yuzawa of IssueHunt, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2025-43877 Kawauchi Manami of NEC Fielding,Ltd. and Toyama Taku of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2025-43879, CVE-2025-48890 Chuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer.