CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.24)
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to and including 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin.
find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input, leading to a command injection vulnerability.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the function 'sub_7D858'.
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the 'initIpAddrInfo' function. This function reads a user-provided parameter, and the variable is passed to the function without any length check.
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the function 'sub_34FD0'. This function reads user-provided parameters and passes variables to another function without length checks.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the 'formWifiBasicSet' function.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in function 'sub_73004'.
Tengda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the 'R7WebsSecurityHandler' function.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the 'add_white_node' function.
Tenda AC6 version US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to buffer overflow in the 'fromGetWirelessRepeat' function.
The Tenda AC6 device has a command execution vulnerability in the 'sub_ADF3C' function. In the 'formSetIptv' function, the 'list' and 'vlanId' parameters are passed unfiltered, allowing for arbitrary command execution.
The 'sub_3A1D0' function in Tenda AC6 firmware contains a command execution vulnerability, allowing attackers to remotely execute code.
The Tenda AC6 device has a command execution vulnerability in the 'sub_ADD50' function. In the 'formSetIptv' function, unfiltered passing of the 'list' and 'vlanId' fields as parameters to the 'sub_ADD50' function allows for command execution.
Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were found to contain a stack overflow via parameter mac at url /goform/GetParentControlInfo.
Tenda AC7 V1.0, AC9 V3.0, and AC5 US devices were found to have a stack overflow vulnerability via the 'time' parameter at the URL /goform/PowerSaveSet.
Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were found to contain a stack overflow vulnerability via parameters startIp and endIp at url /goform/SetPptpServerCfg.
The Tenda AC9 V3.0 in version V15.03.06.42_multi was found to contain a stack overflow via the parameter firewallEn at the URL /goform/SetFirewallCfg.
Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were found to have a stack overflow vulnerability via the page parameter at the url /goform/NatStaticSetting.
Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter timeZone at url /goform/SetSysTimeCfg.
Tenda AC7 V1.0 V15.03.06.44 and Tenda AC5 V1.0RTL_V15.03.06.28 were found to contain a stack overflow vulnerability via parameter entries in the mitInterface at the url /goform/addressNat.