CVE Database

CVE-2026-51706 Medium · 4.3 CWE-284 Aug 31, 2026

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6…

Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51705 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6…

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51704 Medium · 4.3 CWE-284 Aug 31, 2026

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6…

Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51703 Medium · 5.4 CWE-284 Aug 31, 2026

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6…

Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter when Wi-Fi is available via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51702 Medium · 4.3 CWE-284 Aug 31, 2026

Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6…

Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter firewall policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51701 Critical · 9.1 CWE-284 Aug 31, 2026

Incorrect access control in the setMacFilterRules function of TOTOLINK T6…

Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change device access control via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51700 Critical · 9.1 CWE-284 Aug 31, 2026

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6…

Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade wireless behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51699 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51698 Critical · 9.1 CWE-284 Aug 31, 2026

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6…

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51697 Critical · 9.1 CWE-284 Aug 31, 2026

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…

Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter IPTV service configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51696 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the setPortForwardRules function of TOTOLINK T6…

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose internal services via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51695 High · 7.5 CWE-284 Aug 31, 2026

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51694 High · 7.5 CWE-284 Aug 31, 2026

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6…

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51693 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6…

Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51692 Critical · 9.1 CWE-284 Aug 31, 2026

Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6…

Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to establish or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51691 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the setUploadSetting function of TOTOLINK T6…

Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51690 Critical · 9.1 CWE-284 Aug 31, 2026

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…

Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51689 Critical · 9.1 CWE-284 Aug 31, 2026

Incorrect access control in the setUpgradeFW function of TOTOLINK T6…

Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51688 High · 7.5 CWE-284 Aug 31, 2026

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6…

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service (DoS) via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51687 Critical · 9.1 CWE-284 Aug 31, 2026

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6…

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51686 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6…

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51684 Critical · 9.8 CWE-284 Aug 31, 2026

Incorrect access control in the setStorageCfg function of TOTOLINK T6…

Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-51683 Medium · 4.3 CWE-284 Aug 31, 2026

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015…

Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter LAN network configuration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

CVE-2026-78076 Medium · 5.1 CWE-284 Aug 31, 2026

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit modified layout parameters for arbitrary menu items without proper authorization.

CVE-2026-78074 High · 8.8 CWE-284 Aug 31, 2026

Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions

Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.