Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-51701
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setMacFilterRules function of TOTOLINK T6…
Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51700
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6…
Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51699
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51698
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setUrlFilterRules function of TOTOLINK T6…
Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51697
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51696
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the setPortForwardRules function of TOTOLINK T6…
Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose internal services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51695
Alta · 7.5
CWE-284 31/08/2026
Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51694
Alta · 7.5
CWE-284 31/08/2026
Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6…
Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51693
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the setVpnPassCfg function of TOTOLINK T6…
Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51692
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6…
Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51691
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the setUploadSetting function of TOTOLINK T6…
Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51690
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51689
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setUpgradeFW function of TOTOLINK T6…
Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51688
Alta · 7.5
CWE-284 31/08/2026
Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6…
Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service (DoS) via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51687
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6…
Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51686
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6…
Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51684
Crítica · 9.8
CWE-284 31/08/2026
Incorrect access control in the setStorageCfg function of TOTOLINK T6…
Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51683
Média · 4.3
CWE-284 31/08/2026
Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-78076
Média · 5.1
CWE-284 31/08/2026
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.
CVE-2026-78074
Alta · 8.8
CWE-284 31/08/2026
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.
CVE-2026-51681
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setRemoteCfg function of TOTOLINK T6…
Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51680
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51679
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setPasswordCfg function of TOTOLINK T6…
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51678
Média · 4.3
CWE-284 31/08/2026
Incorrect access control in the setSyslogCfg function of TOTOLINK T6…
Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter logging behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51677
Crítica · 9.1
CWE-284 31/08/2026
Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…
Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.