CVE-2026-15413 | Critical | 10.0 | 2026-08-13 | The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link… |
CVE-2026-18844 | High | 8.1 | 2026-08-11 | The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent… |
CVE-2026-17032 | Critical | 9.8 | 2026-08-06 | Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deplo… |
CVE-2026-14812 | Critical | 10.0 | 2026-08-06 | The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enabl… |
CVE-2026-11976 | Critical | 10.0 | 2026-08-06 | The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the ve… |
CVE-2026-61515 | Critical | 9.8 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrar… |
CVE-2026-18191 | Critical | 9.8 | 2026-07-29 | VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to… |
CVE-2026-4769 | Critical | 9.8 | 2026-07-13 | Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not f… |
CVE-2026-7413 | High | 7.2 | 2026-05-07 | A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functiona… |
CVE-2026-41446 | Critical | 9.8 | 2026-04-28 | Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address… |
CVE-2026-1952 | Critical | 9.8 | 2026-04-24 | Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability. |
CVE-2026-34769 | High | 7.7 | 2026-04-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-be… |
CVE-2026-4621 | Medium | 5.6 | 2026-03-27 | Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network. |
CVE-2026-33280 | Critical | 9.8 | 2026-03-27 | Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, result… |
CVE-2026-31847 | High | 8.8 | 2026-03-23 | Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Teln… |
CVE-2026-3587 | Critical | 10.0 | 2026-03-23 | An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device. |
CVE-2026-30704 | Critical | 9.1 | 2026-03-18 | The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB |
CVE-2025-48418 | Medium | 6.7 | 2026-03-10 | A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, Fort… |
CVE-2026-1741 | Medium | 6.6 | 2026-02-02 | A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the file /sess-bin/d.cgi of the component De… |
CVE-2025-55704 | Medium | 5.3 | 2026-01-29 | Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product… |
CVE-2025-11544 | | | 2025-12-22 | Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware. |
CVE-2025-62773 | Low | 2.4 | 2025-10-22 | Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator. |
CVE-2025-58778 | High | 7.2 | 2025-10-16 | Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It is not documented in the manual, and enabled in the initial con… |
CVE-2025-11673 | High | 7.2 | 2025-10-13 | SOOP-CLM developed by PiExtract has a Hidden Functionality vulnerability, allowing privileged remote attackers to exploit a hidden functionality to execute arb… |
CVE-2025-55075 | Medium | 4.9 | 2025-09-17 | Hidden functionality issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, SSH may be enabled by a remote authenticated attacker. |
CVE-2025-30064 | | | 2025-08-27 | An insufficiently secured internal function allows session generation for arbitrary users. The decodeParam function checks the JWT but does not verify which si… |
CVE-2025-9382 | Medium | 6.4 | 2025-08-24 | A weakness has been identified in FNKvision Y215 CCTV Camera 10.194.120.40. This vulnerability affects unknown code of the file s1_rf_test_config of the compon… |
CVE-2010-20103 | Critical | 9.8 | 2025-08-20 | A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a… |
CVE-2025-8938 | Medium | 6.3 | 2025-08-14 | A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet… |
CVE-2011-10018 | Critical | 9.8 | 2025-08-13 | myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP co… |
CVE-2025-46267 | Medium | 4.9 | 2025-07-22 | Hidden functionality issue exists in WRC-BE36QS-B and WRC-W701-B. If exploited, the product's hidden debug function may be enabled by a remote attacker who can… |
CVE-2025-34117 | | | 2025-07-16 | A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an… |
CVE-2025-6839 | Medium | 6.3 | 2025-06-29 | A vulnerability, which was classified as critical, has been found in Conjure Position Department Service Quality Evaluation System up to 1.0.11. Affected by th… |
CVE-2025-26412 | Medium | 6.8 | 2025-06-11 | The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on the modem. An attack… |
CVE-2025-48416 | High | 8.1 | 2025-05-21 | An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the defa… |
CVE-2025-47729 | Low | 1.9 | 2025-05-08 | The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functio… |
CVE-2025-32370 | High | 7.2 | 2025-04-06 | Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed… |
CVE-2025-2894 | Medium | 6.6 | 2025-03-28 | The Go1 also known as "The World's First Intelligence Bionic Quadruped Robot Companion of Consumer Level," contains an undocumented backdoor that can enable th… |
CVE-2025-27840 | Medium | 6.8 | 2025-03-08 | Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory). |
CVE-2025-1204 | | | 2025-02-25 | The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing device network set… |
CVE-2025-0675 | High | 7.5 | 2025-02-07 | Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure. |
CVE-2025-0626 | High | 7.5 | 2025-01-30 | The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings… |
CVE-2024-39754 | Critical | 10.0 | 2025-01-14 | A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to ro… |
CVE-2024-13062 | High | 7.2 | 2025-01-02 | An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution.
Refer to the ' 01/02/202… |
CVE-2024-10773 | Critical | 9.0 | 2024-12-06 | The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with… |
CVE-2024-47001 | High | 8.8 | 2024-09-18 | Hidden functionality issue in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an… |
CVE-2024-45697 | Critical | 9.8 | 2024-09-16 | Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote… |
CVE-2024-45696 | High | 8.8 | 2024-09-16 | Certain models of D-Link wireless routers contain hidden functionality. By sending specific packets to the web service, the attacker can forcibly enable the te… |
CVE-2024-37994 | Medium | 4.3 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-37990 | Medium | 6.5 | 2024-09-10 | A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)… |
CVE-2024-20439 | Critical | 9.8 | 2024-09-04 | A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static admini… |
CVE-2024-5633 | | | 2024-07-09 | Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the same local network to… |
CVE-2024-6045 | High | 8.8 | 2024-06-17 | Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the de… |
CVE-2024-5514 | Critical | 9.8 | 2024-05-30 | MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management… |
CVE-2024-33583 | Low | 3.3 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-3016 | Critical | 9.1 | 2024-05-14 | NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change sett… |
CVE-2024-28011 | Critical | 9.8 | 2024-03-28 | Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS)… |
CVE-2024-22044 | High | 7.5 | 2024-03-12 | A vulnerability has been identified in SENTRON 3KC ATC6 Expansion Module Ethernet (3KC9000-8TL75) (All versions). Affected devices expose an unused, unstable h… |
CVE-2023-42134 | Medium | 6.8 | 2024-01-15 | PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier can allow the signed partition overwrite and subsequently local code… |
CVE-2023-4467 | Medium | 6.2 | 2023-12-29 | A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test A… |
CVE-2023-6614 | Low | 2.7 | 2023-12-08 | A vulnerability classified as problematic was found in Typecho 1.2.1. Affected by this vulnerability is an unknown functionality of the file /admin/manage-page… |
CVE-2023-40158 | High | 8.8 | 2023-08-23 | Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its set… |
CVE-2023-25183 | High | 8.3 | 2023-05-22 |
In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could all… |
CVE-2022-38452 | High | 7.2 | 2023-03-21 | A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted network request… |
CVE-2022-36429 | High | 7.2 | 2023-03-21 | A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON ob… |
CVE-2021-36403 | Medium | 5.3 | 2023-03-06 | In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing ri… |
CVE-2023-24108 | Critical | 9.8 | 2023-02-22 | MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request package (requirements.txt). This vulnerab… |
CVE-2022-3843 | Critical | 9.1 | 2023-02-16 | In WAGO Unmanaged Switch (852-111/000-001) in firmware version 01 an undocumented configuration interface without authorization allows an remote attacker to re… |
CVE-2022-47767 | Critical | 9.8 | 2023-01-26 | A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects Solar-Log dev… |
CVE-2023-22316 | Medium | 6.5 | 2023-01-17 | Hidden functionality vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a network-adjacent attacker to access the produ… |
CVE-2022-46997 | Critical | 9.8 | 2022-12-14 | Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows… |
CVE-2022-46996 | Critical | 9.8 | 2022-12-14 | vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability… |
CVE-2022-3203 | Critical | 9.8 | 2022-10-21 | On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or… |
CVE-2022-1741 | Medium | 6.8 | 2022-06-24 | The tested version of Dominion Voting Systems ImageCast X has a Terminal Emulator application which could be leveraged by an attacker to gain elevated privileg… |
CVE-2017-20084 | Medium | 5.3 | 2022-06-22 | A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by this vulnerability is an unknown funct… |
CVE-2017-20083 | Medium | 5.3 | 2022-06-22 | A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected is an unknown function of the componen… |
CVE-2017-20082 | Medium | 5.5 | 2022-06-22 | A vulnerability, which was classified as problematic, has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. This issue affects some unknown process… |
CVE-2021-4229 | Medium | 5.0 | 2022-05-24 | A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a… |
CVE-2021-24867 | Critical | 9.8 | 2022-02-21 | Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes… |
CVE-2021-43987 | Critical | 9.8 | 2021-12-23 | An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cann… |
CVE-2020-28593 | High | 8.1 | 2021-04-15 | A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object… |
CVE-2021-25371 | Medium | 6.1 | 2021-03-26 | A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP. |
CVE-2020-3352 | Medium | 5.5 | 2020-10-21 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnera… |
CVE-2020-12504 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-16204 | Critical | 9.8 | 2020-09-01 | The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device… |
CVE-2020-14487 | Critical | 9.4 | 2020-07-29 | OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allo… |
CVE-2018-17919 | Medium | 6.5 | 2018-10-10 | All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its defau… |