Archive
9 August 2026
Vulnerabilities first published on this day (UTC), newest first.
4 results · Clear filters · Feed
-
Critical 9.8
Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection
A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument …
-
Critical 9.8CVE-2026-15038 Public exploit
InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their o…
-
Critical 9.1
WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
-
Critical 9.8
MSI Radix AXE6600 v781521 Command Injection via openvpn function
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject mali…