CVE-2026-78063

Publié : 23 août 2026

Modifié : 23 août 2026

Score CVSS

7.4

HIGH

Description détaillée

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Références et Patchs

https://candle-throne-f75.notion.site/Tenda-CH22-formeditFileName-396df0aa1185804c9dcff01778515d32 https://vuldb.com/cve/CVE-2026-78063 https://vuldb.com/submit/881838 https://vuldb.com/vuln/394303 https://vuldb.com/vuln/394303/cti https://www.tenda.com.cn/

Dernières Vulnérabilités

CVE-2026-77116

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.

VOIR DÉTAILS

CVE-2026-77115

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.

VOIR DÉTAILS

CVE-2026-77003

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability.

VOIR DÉTAILS