cve,link,title,description,vendor,products,score,severity,epss,cisa,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2019-13374,https://securityvulnerability.io/vulnerability/CVE-2019-13374,,A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter.,D-Link,Central Wifimanager,6.1,MEDIUM,0.001509999972768128,false,false,false,false,,false,false,2019-07-06T23:15:00.000Z,0
CVE-2019-13373,https://securityvulnerability.io/vulnerability/CVE-2019-13373,,An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL.,D-Link,Central Wifimanager,9.8,CRITICAL,0.4946900010108948,false,false,false,false,,false,false,2019-07-06T23:15:00.000Z,0
CVE-2019-13372,https://securityvulnerability.io/vulnerability/CVE-2019-13372,,"/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication.",D-Link,Central Wifimanager,9.8,CRITICAL,0.9534299969673157,false,false,false,false,,false,false,2019-07-06T23:15:00.000Z,0
CVE-2019-13375,https://securityvulnerability.io/vulnerability/CVE-2019-13375,,A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth parameter passcode. The vulnerability does not need any authentication.,D-Link,Central Wifimanager,9.8,CRITICAL,0.005109999794512987,false,false,false,false,,false,false,2019-07-06T23:15:00.000Z,0
CVE-2018-15515,https://securityvulnerability.io/vulnerability/CVE-2018-15515,,"The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse ""quserex.dll"" from the CaptivelPortal.exe subdirectory under the D-Link directory, which allows unprivileged local users to gain SYSTEM privileges.",D-Link,Central Wifimanager,7.8,HIGH,0.000539999979082495,false,false,false,false,,false,false,2019-01-31T19:00:00.000Z,0
CVE-2018-15516,https://securityvulnerability.io/vulnerability/CVE-2018-15516,,"The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT command bounce scan via port 8000, resulting in SSRF.",D-Link,Central Wifimanager,5.8,MEDIUM,0.0026000000070780516,false,false,false,false,,false,false,2019-01-31T19:00:00.000Z,0
CVE-2018-15517,https://securityvulnerability.io/vulnerability/CVE-2018-15517,,"The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ URI.",D-Link,Central Wifimanager,8.6,HIGH,0.004139999859035015,false,false,false,false,,false,false,2019-01-31T19:00:00.000Z,0
CVE-2018-17443,https://securityvulnerability.io/vulnerability/CVE-2018-17443,,An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'sitename' parameter of the UpdateSite endpoint is vulnerable to stored XSS.,D-Link,Central Wifimanager,6.1,MEDIUM,0.01228999998420477,false,false,false,false,,false,false,2018-10-08T16:00:00.000Z,0
CVE-2018-17442,https://securityvulnerability.io/vulnerability/CVE-2018-17442,,An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerability in the onUploadLogPic endpoint allows remote authenticated users to execute arbitrary PHP code.,D-Link,Central Wifimanager,8.8,HIGH,0.0055599999614059925,false,false,false,false,,false,false,2018-10-08T16:00:00.000Z,0
CVE-2018-17441,https://securityvulnerability.io/vulnerability/CVE-2018-17441,,An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to stored XSS.,D-Link,Central Wifimanager,6.1,MEDIUM,0.01228999998420477,false,false,false,false,,false,false,2018-10-08T16:00:00.000Z,0
CVE-2018-17440,https://securityvulnerability.io/vulnerability/CVE-2018-17440,,"An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves by default on port 9000 and has hardcoded credentials (admin, admin). Taking advantage of this, a remote unauthenticated attacker could execute arbitrary PHP code by uploading any file in the web root directory and then accessing it via a request.",D-Link,Central Wifimanager,9.8,CRITICAL,0.00749000022187829,false,false,false,false,,false,false,2018-10-08T16:00:00.000Z,0