Analysis

Moxa has disclosed CVE-2025-6893, a broken access control flaw classified as CWE-250 (Execution with Unnecessary Privileges) in its network security appliances and routers. A low-privileged authenticated user may be able to access or modify system configuration data, which can lead to privilege escalation. The CNA rates it CVSS 4.0 9.3, and the CISA KEV catalog does not list it in the data consulted.

CVE-2026-3325 is a SQL injection flaw in MegaCMS v12.0.0, located in the id_territorio parameter of the /web_comunications/cms/get_provincias endpoint. The CNA, INCIBE-CERT, rates it critical with a CVSS 4.0 base score of 10, and the record describes it as reachable without authentication during the registration flow. No confirmed exploitation appears in the sources consulted, and the record provides no affected or fixed version data.

CVE-2026-7139 is a command injection flaw in the setWiFiAclRules function of the CGI Handler in TOTOLINK A8000RU firmware 7.1cu.643_b20200521, reachable remotely through /cgi-bin/cstecgi.cgi. The CNA scores it 9.8 under CVSS 3.1, and the record states that an exploit has been published. The record lists no fixed version, and the device is not listed in CISA KEV.

A SQL injection flaw in the WebinarIgnition WordPress plugin by Saleswonder LLC allows blind SQL injection in versions through 4.08.253. The CNA Patchstack rates it critical with a CVSS 3.1 base score of 9.3. The record lists no fixed version and no confirmed exploitation.

VulDB reports a buffer overflow in the loginauth function of /cgi-bin/cstecgi.cgi on the Totolink N300RH running version 3.2.4-B20220812. Manipulating the Password argument can be triggered remotely, and the record states that a public exploit has been released. No fixed version is listed, and the record shows no CISA KEV listing.

CVE-2026-6508 is an Origin Validation Error (CWE-346) in TUBITAK BILGEM's Liderahenk, affecting versions from 2.0.1 before 2.0.2, which allows access to functionality not properly constrained by access control lists. The CNA assigned a CVSS 3.1 base score of 9.8 (critical). No confirmed exploitation appears in the sources consulted, and the record lacks structured affected or fixed version data.

CVE-2026-3893 describes the Carlson VASCO-B GNSS Receiver as lacking an authentication mechanism, so a network-accessible attacker could reach configuration and operational functions without credentials. ICS-CERT assigned a CVSS 3.1 base score of 9.4 (critical), and the record maps the weakness to CWE-306. The sources consulted show no confirmed exploitation, and the record lists no affected or fixed versions.

CVE-2026-41462 is a critical SQL injection flaw in the login function of ProjeQtor versions 7.0 through 12.4.3, where the username value is concatenated into a SQL query without parameterization. The CVSS 3.1 base score in the record is 9.8, and the description states that an unauthenticated attacker could create privileged accounts or read sensitive data. No confirmed exploitation appears in the sources consulted, and the record does not list a fixed version.

CVE-2026-42369 is a stack-based buffer overflow (CWE-787) in Geovision GV-VMS V20 that the CNA rates as Critical with CVSS 3.1 10.0. According to the record, the flaw is in the base64 decoding of data handled by the gvapi endpoint of the WebCam Server web interface. No fixed version, affected version range, or confirmed exploitation appears in the sources consulted.

A flaw classified as OS command injection (CWE-77) has been reported in the CGI Handler of the Totolink A8000RU, firmware 7.1cu.643_b20200521, in the setWizardCfg function. The CNA (VulDB) scores it 9.8 under CVSS 3.1 and states that it can be initiated remotely and that a published exploit may be used. CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.

Totolink A8000RU build 7.1cu.643_b20200521 contains an OS command injection flaw in the setStorageCfg function, triggered through the sambaEnabled argument. The CNA rates it critical with CVSS 3.1 score 9.8, states that remote exploitation is possible, and notes that a public exploit has been disclosed. The record identifies no vendor fix and the CVE is not listed in CISA KEV.

Plane, an open-source project management tool, has a weakness in its magic-code email login in versions before 1.4.0. The six-digit one-time code can be tested repeatedly because failed attempts are not counted, limited, or locked out. The GitHub CNA rates it critical with CVSS 3.1 score 9.1, and it is fixed in 1.4.0; no confirmed exploitation appears in the sources consulted.

CVE-2026-7153 is a critical OS command injection flaw (CWE-77) in the setMiniuiHomeInfoShow function of the CGI Handler of Totolink A8000RU firmware 7.1cu.643_b20200521. The CNA VulDB rates it 9.8 under CVSS 3.1 and states that it can be exploited remotely without privileges or user interaction. The record states that an exploit has been published, but CISA KEV does not list it and the sources consulted do not confirm active exploitation.

CVE-2026-4882 affects the User Registration Advanced Fields plugin for WordPress, where missing file type validation in the URAF_AJAX::method_upload function can allow unauthenticated arbitrary file uploads. The record rates it 9.8 (critical) under CVSS 3.1 and notes that exploitation requires a Profile Picture field in a form. No fixed version appears in the sources consulted, and the CVE is not listed in CISA KEV.

The Orion SMS OTP Verification plugin for WordPress, in all versions up to and including 1.1.7, does not properly verify a user's identity before updating their password. Wordfence reports a CVSS 3.1 base score of 9.8 (critical), and the record describes possible account takeover without authentication when the attacker knows the victim's phone number. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.