Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote attacker corrupt memory by sending a crafted request to /goform/DhcpListClient with a manipulated 'page' parameter, with high confidentiality, integrity and availability impact on the device. Publicly available exploit code exists, including a GitHub proof-of-concept with full reproduction steps, so the barrier to exploitation is low; there is no CISA KEV listing, meaning confirmed active exploitation in the wild has not been established. The vendor-supplied CVSS 4.0 vector advertises an unauthenticated attack (PR:N, base 8.9), but our independent assessment scores it AV:N/AC:L/PR:L/UI:N (CVSS 3.1, all-high impact) because the DHCP client-list endpoint may sit behind the router admin session - if so, valid credentials or an authenticated session are required, and practical exposure is largely limited to attackers on the same LAN unless the web UI is deliberately exposed to the WAN.
Command injection in the DHCP daemon of D-Link DIR-860L B1 and DIR-868L B1 routers running firmware 203b01/203b03 allows an attacker who can reach the device on the same broadcast domain to execute arbitrary shell commands as root by supplying a crafted Hostname (DHCP option 12) string in a DHCP request. Exploitation requires LAN adjacency rather than Internet reachability - DHCP is not routable, so the source data's 'remote' label is constrained to local-network delivery - but needs no authentication and no user interaction against a default-running service (our assessment vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. high confidentiality, integrity and availability impact). Publicly available exploit code exists and is linked from the references, EPSS is 3.80% (90th percentile), and there is no CISA KEV entry or other confirmation of active in-the-wild exploitation; no vendor-released patch has been identified, and both models are end-of-life hardware revisions.
Stack-based buffer overflow in the Tenda AC20 router running firmware 16.03.08.12 allows a remote attacker to overwrite stack memory by sending a crafted rebootTime value to the formSetRebootTimer handler behind /goform/SetSysAutoRebbotCfg, leading to a daemon crash and potential arbitrary code execution in the httpd process. Publicly available exploit code exists, so any unit whose web management interface is reachable from an untrusted network should be treated as at risk. The flaw carries a CVSS 4.0 base score of 7.4 with exploit maturity E:P; the supplied vector indicates low-privilege authentication (PR:L) and no user interaction, but authentication requirements are not confirmed by the description, and this bug class is frequently pre-authentication on Tenda devices, so the true prerequisite should be verified against the firmware.
A stack-based buffer overflow in the httpd component of Tenda AC20 firmware 16.03.08.12 allows a remote attacker to overwrite memory on the stack by submitting an oversized 'list' argument to the /goform/setPptpUserList endpoint, which is processed by the formSetPPTPUserList function. Based on the CVSS vector the attacker must first authenticate with at least low-privilege credentials (PR:L) and be able to reach the device's web-management interface, which is normally confined to the LAN unless remote management is enabled or the router is directly exposed. Publicly available exploit code exists (a public write-up with proof-of-concept is linked from the NVD references), and EPSS assigns a 3.33% exploitation likelihood (88th percentile), but there is no confirmed active exploitation (CISA KEV) and no vendor-released patch identified at the time of analysis.
Stack-based buffer overflow in the Tenda AC20 router (firmware 16.03.08.12) allows an authenticated attacker who can reach the device's management web interface to corrupt memory and potentially execute code or crash the httpd service by sending an oversized schedStartTime or schedEndTime value to the /goform/openSchedWifi endpoint. The issue carries a CVSS 4.0 score of 7.4 (E:P) and our independent assessment scores it CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity and availability impact once a low-privilege session is established. Publicly available exploit code exists, though EPSS is low at 0.74% (53rd percentile) and there is no confirmed active exploitation (not listed in CISA KEV).
NXLog Agent versions before 6.11 honor the OPENSSL_CONF environment variable when initializing its OpenSSL runtime, allowing a local attacker who can control that variable to point the agent at a malicious configuration file that loads arbitrary engines or providers, which amounts to code execution in the agent's security context. The flaw is a CWE-829 configuration-injection issue with a local-only vector and high attack complexity, and it is most dangerous where the agent service runs with higher privileges than the attacker, creating a privilege-escalation path; it cannot be reached over the network. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the EPSS score of 0.12% (2nd percentile) indicates low predicted exploitation activity.
Unauthenticated SQL injection in the wpForo Forum plugin for WordPress (all versions through 2.4.12) allows remote attackers to append arbitrary SQL to the plugin's existing queries via the post_args and topic_args parameters, exposing sensitive database contents such as user credentials and secrets. The flaw is network-reachable and needs no authentication or user interaction (CVSS 7.5, PR:N/UI:N), requiring only that the plugin be installed, active, and its forum/topic pages reachable - default installations are affected, and exploitation is limited to confidentiality impact (no data modification or direct site takeover, though harvested credentials could enable follow-on compromise). No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is modest (0.38%, 29th percentile), making this a credible but not emergency-level priority.