OS command injection in WAVLINK WN553X1-B firmware 260403_2.0.0 allows remote attackers with high-privilege administrative access to execute arbitrary OS commands by manipulating the file_id argument passed to the sub_416B50 function in /bin/ioos. The assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, so the main limiting prerequisite is authenticated administrative access rather than unauthenticated reachability. A public PoC reference exists at a GitHub advisory, but it is not verified as working exploit code, and no CISA KEV entry is indicated.
OS command injection in the del_vlan_group function of the WAVLINK WN701AE (firmware 260105) ioos web backend allows network-reachable attackers to execute arbitrary shell commands on the device. The CVSS 4.0 vector (PR:L, AC:L, UI:N) shows a low-complexity attack that requires a low-privilege authenticated session on the web management interface, with high confidentiality, integrity and availability impact across the vulnerable and subsequent systems; an EPSS-style exploitability metric of E:P and a public PoC reference (not verified as working exploit code) exist. No CISA KEV entry confirms active exploitation, but the flaw is considered high priority this week because of its severity and the presence of public technical detail.
OS command injection in the WAVLINK WN701AE (firmware M01AE_V260105) ioos web backend lets a network-positioned attacker who already holds a low-privileged account execute arbitrary OS commands on the device by manipulating the rule_name argument of the del_staticrule function in static_route_setting.sh. Successful exploitation compromises confidentiality, integrity and availability of the router itself and can extend to connected systems (assessed CVSS:3.1 8.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A public PoC reference exists in a GitHub write-up; it is not verified as working exploit code, and no CISA KEV listing indicates confirmed active exploitation. The vendor was contacted about the disclosure.
OS command injection in the WAVLINK WN553X1-B WireGuard CLI group handler lets an attacker with low-privilege authenticated access pass crafted group_id or group_name values that are executed as operating-system commands by /bin/ioos (sub_41A748) on firmware V260403_2.0.0. The flaw is remotely reachable, requires no user interaction, and can yield high confidentiality, integrity, and availability impact on the device. A public PoC reference exists; it is not verified as working exploit code, and the issue is high severity and prioritized for this week rather than a confirmed widespread-exploitation emergency.
Authenticated low-privilege users of the WAVLINK WN553X1-B router (build V260403_2.0.0) can inject operating system commands through the WireGuard CLI handler in /bin/ioos by manipulating the file_id argument, giving full compromise of confidentiality, integrity and availability on the device. The flaw sits behind the management plane, so exploitation requires valid low-privilege credentials or an authenticated session plus network reachability of the admin/WireGuard interface; attackers on an exposed admin plane gain the highest practical benefit. A public proof-of-concept reference has been published on GitHub (a write-up under a 'HACKALL' repository) and is not verified as working exploit code; there is no CISA KEV entry, and the item is triaged as a this-week priority rather than an emergency.
OS command injection in the ovpn_file handler of the WAVLINK WN553X1-B router (firmware 260403_2.0.0) allows an authenticated, low-privileged attacker who can reach the management interface to pass a crafted file_id argument into an OS command executed by the /bin/ioos binary (function sub_4162A8). Successful exploitation gives high confidentiality, integrity and availability impact on the device and, per the CVSS 4.0 vector, on subsequent systems, with no user interaction required. A public PoC reference exists (a GitHub write-up); it is not verified as working exploit code, there is no CISA KEV listing, and the disclosure is tracked by VulDB with a this-week handling priority.
OS command injection in the OpenVPN CLI handler of WAVLINK WN553X1-B firmware V260403_2.0.0 allows a remote attacker holding low-level (authenticated) privileges to execute arbitrary OS commands by manipulating the file_id argument processed by sub_416568 in /bin/ioos. Successful exploitation gives full compromise of confidentiality, integrity and availability on the device, which is typically positioned at the network edge. No CISA KEV entry or other confirmation of active exploitation was supplied; a public PoC reference exists, but it is not verified as working exploit code, and the vulnerability is prioritized for remediation this week rather than as an emergency.
OS command injection in the port_forward handler of the WAVLINK WL-WN530HG4B router's web management CGI (/cgi-bin/wapi.cgi) allows an attacker who can reach and authenticate to the device's administrative interface to run arbitrary shell commands on the firmware by placing shell metacharacters in the Name argument of a port-forwarding configuration request. The issue affects firmware build M_V260724 and carries a CVSS 4.0 base score of 8.6, with high confidentiality, integrity and availability impact; the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the PR:L prerequisite, meaning the practical bar is authenticated access to the management UI rather than a fully unauthenticated internet-wide attack. A public PoC reference has been published in a GitHub write-up, but it is not verified as working exploit code, and no CISA KEV listing or EPSS score is available at time of analysis.
OS command injection (CWE-78) in the WAVLINK WN579X3-D wireless router (reported at firmware V250402) lets an attacker who can reach the web management interface execute arbitrary shell commands on the device by supplying a crafted 'Name' argument to the port_forward function of /cgi-bin/wapi.cgi. The vendor's CVSS 4.0 vector scores this 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity and availability impact), and the parallel assessment confirms remote reachability with low attack complexity but requires a low-privilege authenticated session on the management interface, so this is not a fully unauthenticated attack; exposure rises sharply where the admin interface is reachable from the WAN or default/weak credentials remain in place. A public PoC reference exists (a GitHub write-up linked from the VulDB entry) but has not been verified as working exploit code, and no confirmed active exploitation (CISA KEV) has been reported. Successful exploitation gives full control of the device's configuration and the traffic it forwards.
OS command injection in WAVLINK WN553X1-B firmware V260403_2.0.0 lets a remote attacker with a low-privilege authenticated session execute arbitrary commands through the group_id and group_name arguments processed by sub_416D88 in /bin/ioos. The issue is CWE-78 and carries a CVSS 4.0 score of 8.6; exploitation requires reachability to the device's ioos Service, which is typically LAN-side or an exposed management interface rather than the open internet by default. A public PoC reference exists; it is not verified as working exploit code, and the supplied intelligence does not confirm active exploitation.
Improper authorization in Oray Pugongying X5 Pro routers (up to and including 7.6.1) lets an authenticated but low-privilege 'restricted' account reach privileged API functionality through the run_apis_by_json/run_async_task JSON batch dispatcher, and the public write-up demonstrates a restricted account invoking a factory reset. Exploitation requires valid restricted credentials plus network reachability to the device's API Authorization interface, with no user interaction needed, and results in high confidentiality, integrity and availability impact (VulDB CVSS 4.0 score 8.6; our CVSS 3.1 assessment is 8.8). No vendor patch is available since Oray did not respond to the disclosure; a public proof-of-concept reference exists but is not verified as working exploit code, there is no CISA KEV entry confirming active exploitation, and no EPSS score was supplied, with prioritization set to 'this week'.
Relative path traversal in the configuration-restore routine (config_restore_ex) of Oray Pugongying X5 Pro firmware up to 7.6.1 allows an authenticated router administrator to supply a crafted filename argument that escapes the intended restore directory; the public write-up links this traversal to root code execution on the device. Exploitation is remote but gated behind the operator/admin-level configuration-restore feature (PR:H in both the CVE and the assessed CVSS 3.1 vector), so a valid admin session or credentials are required first, and no user interaction is needed. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is present, and the vendor did not respond to the disclosure, so no vendor patch or advisory is available. Priority is this_week rather than immediate action: genuine but conditional risk confined to vulnerable firmware on an admin-gated endpoint.
Unauthenticated denial of service against Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P Ethernet switches running firmware ESW_1.0(1)B1P48: anyone who can reach the Local Firmware Upgrade web interface can drive a buffer overflow through the httpupg.cgi endpoint and crash the device. The confirmed impact is availability only (VC:N/VI:N/VA:H) - reboot, lockup or loss of management access - with no demonstrated code execution or data compromise despite the CWE-120 overflow class. No vendor fix has been published (Ruijie did not respond to the disclosure), and a public PoC reference exists but is not verified as working exploit code, so priority is set to this_week rather than emergency.
Memory corruption in the shield.sys kernel driver of Horizon DataSys Reboot Restore Standard (versions up to and including 13.2) allows a local user with only low-level privileges to corrupt kernel memory through the sub_23908 function, with high impact on confidentiality, integrity and availability. The attack is not remote and requires an existing foothold on a Windows host with the product installed, but no user interaction; successful abuse in the kernel context would potentially allow elevation to higher privileges. The CVE record states that exploit code is publicly available (a public gist is referenced), so local attackers who already hold a low-privileged account should be treated as capable of reproducing it; no CISA KEV entry confirms active exploitation.
Apache Wicket's form-less upload endpoint (AbstractFileUploadResource, the server side of FileUploadToResourceField, or a manually mounted FileUploadResourceReference) takes its upload bounds from client-supplied request parameters - maxSize, fileMaxSize and fileCountMax - instead of from the values the application configured via setMaxSize(), setFileMaxSize() and setFileCountMax(). A client that supplies a very large maxSize, or omits the per-part and part-count parameters, can therefore drive one repeatable request to spool unlimited data to disk or read non-file parts into the heap, exhausting disk or memory. Affected releases are 9.14.0 through 9.24.0 and 10.0.0 through 10.9.1; the 8.x line has no such resource, and the ordinary Form/FileUploadField and AjaxFileDropBehavior paths are unaffected because they read limits from the component. Rated CVSS 4.0 8.3 (with attack requirements present, AT:P, since the application must deliberately use or mount this resource) and rated 'this_week' by priority; no public exploit code was identified at time of analysis.
Heap-exhaustion denial of service in Apache Wicket 9.14.0 through 9.24.0 and 10.0.0 through 10.11.0, reachable without authentication (CVSS 4.0 PR:N) by any client that can load a page rendering the FileUploadToResourceField callback URL. The Ajax callback trusts the client-supplied filesInfo JSON without binding it to a real upload, and UploadInfo#get() allocates a byte array sized from the attacker-controlled UploadInfo#getSize() before opening any file, so a single small request can cost close to two gigabytes of heap and repeated requests exhaust the JVM heap for all requests; a size that converts to a negative int instead throws an uncaught NegativeArraySizeException into the application. Exploitation is narrowly scoped: the application must deliberately extend and mount this component (not the ordinary FileUploadField/Form path) and must call UploadInfo#get(); no public exploit code or active exploitation was identified at time of analysis, and the priority label is this_week.
Cross-site scripting in Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 allows text read from the application's resource bundles to escape the single-quoted JavaScript string literals and quoted HTML attribute values the framework generates, so a quote in that text ends the literal or attribute and what follows is parsed as script or markup in the application's origin when the page loads. Only bundle-sourced values rendered by specific components are affected - the org.apache.wicket.mfu.delete message in MultiFileUploadField, the hidden-fields CSS class in Form (and in Form#appendDefaultButtonField on the 8.x and 9.x ranges) and FilterForm, the UploadProgressBar.starting text, and TrapFocusBehavior's current CSS class on 9.0.0-9.24.0 and 10.0.0-10.11.0 - so exploitation depends on a non-default situation in which a bundle entry is influenced by another party, although an ordinary apostrophe in a legitimate translation is enough to break page rendering. The unauthenticated network vector requires the victim to load the generated page; no public exploit identified at time of analysis, and the default Content-Security-Policy in Wicket 9.x and 10.x blocks the attribute-injection cases but not the JavaScript string-literal cases because the generated script carries the per-response nonce the policy trusts.
Cross-site scripting in Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 lets a value that the application places into a component markup id or a component id break out of a single-quoted JavaScript string literal that Wicket itself generates, so the injected script executes in the application's origin when the page loads. Exploitation is conditional: Wicket never generates a quote or backslash in these identifiers, so the tainted value must originate from application data flow (a value passed to Component#setMarkupId, an id attribute in a template, or a component id derived from data), and a victim must load the affected rendered page; the supplied independent assessment scores this as CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, i.e. a genuine but conditional flaw rather than a trivially reachable one. No KEV listing is present and no public exploit code is identified in the available intelligence; the vendor's own advisory carries a CVSS 4.0 score of 7.6 and a this_week remediation priority.
Stored cross-site scripting in Apache Wicket's AjaxNewWindowNotifyingBehavior allows a client-supplied browser window name to be persisted in a page instance's serialized state and later emitted as raw, unescaped JavaScript, executing in the application's origin each time that page instance is rendered. Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 are affected, but only applications that explicitly added the behaviour to a component are exposed, since the framework never installs it; the vector is unauthenticated (PR:N) yet requires victim interaction and specific attack prerequisites, so real-world priority is moderate rather than urgent. No public exploit identified at time of analysis, and the vendor has released fixes in 8.20.0, 9.25.0 and 10.12.0.
Cross-site scripting in Apache Wicket 8.0.0 through 8.19.0 lets remote attackers get script executed in the application's origin when an ExternalLink component is bound to a markup tag that is not an a, link or area element (such as a button or span) and the URL held in the component's model contains attacker-influenceable data, which the vendor describes as the component's ordinary use rather than a misuse. The URL is concatenated unescaped into a single-quoted JavaScript string inside the generated onclick handler, and also into the window.open() call built by PopupSettings when popup settings are attached; only attribute-level markup escaping is applied, and the browser decodes the apostrophe character reference before compiling the handler, restoring the quote and closing the literal. Exploitation is unauthenticated and remote but conditional: nothing executes until a user activates the affected element, and the deployment must bind the component to a non-anchor tag, which the Apache reporter scores as CVSS 4.0 7.4 (AT:P, UI:A); no public exploit identified at time of analysis.
Apache Wicket's public JavaScriptUtils.escapeQuotes() helper fails to escape backslashes before quotes, so attacker-influenced data containing a backslash immediately before a quote can terminate a JavaScript string literal and run script in the application's origin and the viewing user's session. The flaw affects Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0, but exploitation is conditional: an application must itself place the method's output inside a JavaScript string literal, and the bundled AjaxEditableLabel path additionally requires a custom validation message that interpolates submitted input or another attacker-controlled variable. No public exploit was identified at time of analysis, and the issue requires user interaction because the victim must view the page that renders the vulnerable response.
Cross-site scripting in Apache Wicket's SmartLinkLabel and SmartLinkMultiLineLabel components turns attacker-influenced text into anchors whose href is copied verbatim, so a value naming a script-executing scheme becomes a clickable script link in the application's origin and the reader's session. Affected are Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0, but only applications that render untrusted text through one of those two components; no other component uses DefaultLinkParser. Exploitation is not a drive-by: the reader must click the injected link, and on 9.x and 10.x the default nonce-based Content-Security-Policy blocks the script unless the deployment has weakened or disabled it, while 8.x has no CSP support and is exposed as it stands. No public exploit code was identified at time of analysis; fixed releases are 8.20.0, 9.25.0 and 10.12.0.
Session fixation in Apache Wicket's role-based authentication module leaves the container session id unchanged when an already-signed-in session authenticates a second time, so an attacker-planted session id can survive a successful login. Affected releases are 8.18.0 through 8.19.0, 9.23.0 through 9.24.0 and 10.9.0 through 10.11.0, and exploitation requires an application that authenticates via AuthenticatedWebSession, permits re-authentication of a signed-in session (step-up prompt, account switch, or a sign-in form still reachable after login), and an attacker who can plant a session id in the victim's browser and has already authenticated that session with a valid account (PR:L, UI:A). Successful exploitation yields high confidentiality and integrity impact within the vulnerable application; the vendor-released fix is available in 8.20.0, 9.25.0 and 10.12.0, and no public exploit has been identified at time of analysis. The CVSS 4.0 base score is 7.2 (High), though the vector is tempered by AT:P (an attack requirement outside the attacker's control) alongside PR:L and UI:A.
Stored cross-site scripting in the Nickboss WordPress File Upload plugin, versions up to and including 5.2.1, allows an attacker to persist script that executes in a victim's browser when the victim loads the affected page. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, giving a base score of 7.1; the UI:R component means a user must load the page containing the stored payload for execution to occur. The CVSS vector lists no privileges required (PR:N), though the description does not state the required access level, so the unauthenticated nature should be verified with the vendor or Patchstack. No public exploit code or active exploitation is identified in the available sources at time of analysis, and no EPSS score was supplied.