Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 698

Export CSV
CVE-2026-0732

D-Link DI-8200G upgrade_filter.asp command injection

A vulnerability was found in D-Link DI-8200G 17.12.20A1. This affects an unknown function of the file /upgrade_filter.asp. The manipulation of the argument path results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS 11.7% KEV · Not listed
Vendors
D-link Dlink
Products
Di-8200g Di-8200g Di-8200g Firmware
CVE-2026-1125

D-Link DIR-823X set_wifidog_settings sub_412E7C command injection

A weakness has been identified in D-Link DIR-823X 250416. Affected by this issue is the function sub_412E7C of the file /goform/set_wifidog_settings. Executing a manipulation of the argument wd_enable can lead to command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS 15.7% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-823x Dir-823x Dir-823x Firmware
CVE-2026-1419

D-Link DCS700l Web Form setDayNightMode command injection

A weakness has been identified in D-Link DCS700l 1.03.09. Affected is an unknown function of the file /setDayNightMode of the component Web Form Handler. Executing a manipulation of the argument LightSensorControl can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 5.1 Medium EPSS 17.2% KEV · Not listed
Vendors
D-link Dlink
Products
Dcs700l Dcs-700l Dcs-700l Firmware
CVE-2026-1448

D-Link DIR-615 Web Management wiz_policy_3_machine.php os command injection

A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the component Web Management Interface. Performing a manipulation of the argument ipaddr results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.6 High EPSS 5.8% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-615 Dir-615 Dir-615 Firmware
CVE-2026-1505

D-Link DIR-615 URL Filter set_temp_nodes.php os command injection

A vulnerability was found in D-Link DIR-615 4.10. This issue affects some unknown processing of the file /set_temp_nodes.php of the component URL Filter. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 8.6 High EPSS 5.1% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-615 Dir-615 Dir-615 Firmware
CVE-2026-1532

D-Link DCS-700L Music File Upload Service setUploadMusic uploadmusic path traversal

A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music File Upload Service. The manipulation of the argument UploadMusic leads to path traversal. The attack can only be initiated within the local network. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
D-link Dlink
Products
Dcs-700l Dcs-700l Dcs-700l Firmware
CVE-2026-1544

D-Link DIR-823X set_mode sub_41E2A0 os command injection

A security flaw has been discovered in D-Link DIR-823X 250416. Impacted is the function sub_41E2A0 of the file /goform/set_mode. Performing a manipulation of the argument lan_gateway results in os command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS 3.8% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-823x Dir-823x Dir-823x Firmware
CVE-2026-1596

D-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injection

A flaw has been found in D-Link DWR-M961 1.1.47. This vulnerability affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
D-link Dlink
Products
Dwr-m961 Dwr-m961 Dwr-m961 Firmware
CVE-2026-1625

D-Link DWR-M961 SMS Message formSmsManage sub_4250E0 command injection

A vulnerability was detected in D-Link DWR-M961 1.1.47. The impacted element is the function sub_4250E0 of the file /boafrm/formSmsManage of the component SMS Message. Performing a manipulation of the argument action_value results in command injection. The attack may be initiated remotely. The exploit is now public and may be used.

CVSS 4.0 · 5.3 Medium EPSS 3.0% KEV · Not listed
Vendors
D-link Dlink
Products
Dwr-961 Dwr-m961 Dwr-m961 Firmware
CVE-2026-1685

D-Link DIR-823X Login sub_40AC74 excessive authentication

A vulnerability was identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_40AC74 of the component Login. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit is publicly available and might be used.

CVSS 4.0 · 6.3 Medium EPSS 1.2% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-823x Dir-823x Dir-823x Firmware
CVE-2026-1705

D-Link DSL-6641K Web ad_virtual_server_vdsl cross site scripting

A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function ad_virtual_server_vdsl of the component Web Interface. Performing a manipulation of the argument Name results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
D-link
Products
Dsl-6641k
CVE-2026-1744

D-Link DSL-6641K sp_pppoe_user.js doSubmitPPP cross site scripting

A vulnerability was found in D-Link DSL-6641K N8.TR069.20131126. Affected by this issue is the function doSubmitPPP of the file sp_pppoe_user.js. The manipulation of the argument Username results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
D-link Dlink
Products
Dsl-6641k Dsl-6641k Dsl-6641k Firmware
CVE-2026-2055

D-Link DIR-605L/DIR-619L DHCP Client Information information disclosure

A weakness has been identified in D-Link DIR-605L and DIR-619L 2.06B01/2.13B01. The affected element is an unknown function of the component DHCP Client Information Handler. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 6.9 Medium EPSS 1.1% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-605l Dir-619l Dir-605l and 3 more
CVE-2026-2063

D-Link DIR-823X Web Management set_ac_server os command injection

A security flaw has been discovered in D-Link DIR-823X 250416. This vulnerability affects unknown code of the file /goform/set_ac_server of the component Web Management Interface. The manipulation of the argument ac_server results in os command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 5.1 Medium EPSS 5.3% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-823x Dir-823x Dir-823x Firmware
CVE-2026-2081

D-Link DIR-823X set_password os command injection

A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. This manipulation of the argument http_passwd causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.1 Medium EPSS 6.4% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-823x Dir-823x Dir-823x Firmware
CVE-2026-2082

D-Link DIR-823X set_mac_clone os command injection

A vulnerability was identified in D-Link DIR-823X 250416. The impacted element is an unknown function of the file /goform/set_mac_clone. Such manipulation of the argument mac leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.

CVSS 4.0 · 5.1 Medium EPSS 5.9% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-823x Dir-823x Dir-823x Firmware
CVE-2026-2120

D-Link DIR-823X Configuration Parameter set_server_settings os command injection

A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/set_server_settings of the component Configuration Parameter Handler. The manipulation of the argument terminal_addr/server_ip/server_port leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 8.6 High EPSS 4.7% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-823x Dir-823x Dir-823x Firmware
CVE-2026-2129

D-Link DIR-823X set_ac_status os command injection

A vulnerability was found in D-Link DIR-823X 250416. Affected by this issue is some unknown functionality of the file /goform/set_ac_status. Performing a manipulation of the argument ac_ipaddr/ac_ipstatus/ap_randtime results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used.

CVSS 4.0 · 8.6 High EPSS 5.0% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-823x Dir-823x Dir-823x Firmware
CVE-2026-2142

D-Link DIR-823X set_qos sub_420688 os command injection

A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420688 of the file /goform/set_qos. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 8.6 High EPSS 6.6% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-823x Dir-823x Dir-823x Firmware
CVE-2026-2143

D-Link DIR-823X DDNS Service set_ddns os command injection

A security vulnerability has been detected in D-Link DIR-823X 250416. This issue affects some unknown processing of the file /goform/set_ddns of the component DDNS Service. The manipulation of the argument ddnsType/ddnsDomainName/ddnsUserName/ddnsPwd leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 8.6 High EPSS 5.0% KEV · Not listed
Vendors
D-link Dlink
Products
Dir-823x Dir-823x Dir-823x Firmware