CVE-2026-37152

Publié : 15 septembre 2026

Modifié : 16 septembre 2026

Lien officiel NVD

Score CVSS

9.8

CRITICAL

Description détaillée

TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://github.com/AndreaLandriscina/Hardcoded-Password-Totolink-X5000R https://github.com/AndreaLandriscina/Hardcoded-Password-Totolink-X5000R/tree/main https://github.com/AndreaLandriscina/Hardcoded-Password-Totolink-X5000R

Dernières Vulnérabilités

CVE-2026-93923

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.

VOIR DÉTAILS

CVE-2026-93922

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

VOIR DÉTAILS

CVE-2026-93921

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.

VOIR DÉTAILS