CVE Database

CVE-2026-82829 Critical · 9.8 CWE-912 Oct 1, 2026

Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process

Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This issue affects Hitachi Coding Software Suite: through 3.3.0.

CVE-2026-80217 High · 8.8 CWE-912 Sep 15, 2026

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user…

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands.

CVE-2026-15413 Critical · 10.0 CWE-912 Aug 13, 2026

Link Factory - Backdoor

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).

CVE-2026-18844 High · 8.1 CWE-912 Aug 11, 2026

Pulsetto Vagus Nerve Stimulator Hidden Functionality

The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.

CVE-2026-17032 Critical · 9.8 CWE-912 Aug 6, 2026

Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

CVE-2026-14812 Critical · 10.0 CWE-912 Aug 6, 2026

Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection)

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.

CVE-2026-11976 Critical · 10.0 CWE-912 Aug 6, 2026

MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.

CVE-2026-61515 Critical · 9.8 CWE-912 Aug 4, 2026

Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise.

CVE-2026-18191 Critical · 9.8 CWE-912 Jul 29, 2026

Vacron｜IP Camera - Hidden Functionality

VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device.

CVE-2026-4769 Critical · 9.8 CWE-912 Jul 13, 2026

Unauthenticated Access to Internal Diagnostic Interface

Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise.

CVE-2026-7413 Critical · 9.8 CWE-912 May 7, 2026

Persistent undocumented backdoor access in Yarbo robot

A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factory reset and ordinary firmware updates.

CVE-2026-1952 High · 7.5 CWE-912 Apr 24, 2026

Denial of service via the undocumented subfunction in AS320T

Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.

CVE-2026-4621 Medium · 5.6 CWE-912 Mar 27, 2026

Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker…

Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network.

CVE-2026-33280 Critical · 9.8 CWE-912 Mar 27, 2026

Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an…

Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands.

CVE-2026-31847 High · 8.8 CWE-912 Mar 23, 2026

Hidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+

Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activate a Telnet service on port 23.

CVE-2026-3587 Critical · 10.0 CWE-912 Mar 23, 2026

Hidden CLI Function Allows Root Access

An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device.

CVE-2026-30704 Critical · 9.1 CWE-912 Mar 18, 2026

The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART…

The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB

CVE-2025-48418 High · 7.2 CWE-912 Mar 10, 2026

A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3…

A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 through 7.0.14, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.10, FortiAnalyzer Cloud 7.0.1 through 7.0.14, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.10, FortiManager 7.0.0 through 7.0.14, FortiManager 6.4 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14, FortiManager Cloud 6.4 all versions may allow a remote authenticated read-only admin with CLI access to escalate their privilege via use of a hidden command.

CVE-2026-1741 Medium · 6.6 CWE-912 Feb 2, 2026

EFM ipTIME A8004T Debug d.cgi httpcon_check_session_url backdoor

A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-55704 Medium · 5.3 CWE-912 Jan 29, 2026

Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd…

Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product and obtain sensitive information within the logs.

CVE-2025-11544 Critical · 9.5 CWE-912 Dec 22, 2025

Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions…

Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware.

CVE-2025-62773 Low · 2.4 CWE-912 Oct 22, 2025

Mercku M6a devices through 2.1.0 allow TELNET sessions via a…

Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator.

CVE-2025-58778 High · 7.2 CWE-912 Oct 16, 2025

Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server…

Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It is not documented in the manual, and enabled in the initial configuration. Anyone with the knowledge of the related credentials can log in to the affected device, leading to information disclosure, altering the system configurations, or causing a denial of service (DoS) condition.

CVE-2025-11673 High · 7.2 CWE-912 Oct 13, 2025

PiExtract ｜SOOP-CLM - Hidden Functionality

SOOP-CLM developed by PiExtract has a Hidden Functionality vulnerability, allowing privileged remote attackers to exploit a hidden functionality to execute arbitrary code on the server.

CVE-2025-47729 Medium · 4.9 KEV CWE-912 May 8, 2025

TeleMessage TM SGNL Hidden Functionality Vulnerability

The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage "End-to-End encryption from the mobile phone through to the corporate archive" documentation, as exploited in the wild in May 2025.