CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-6139 — A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This af...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Analysis

A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. CVSS Score: 9.8. Published: 2026-04-13T01:16:35.500.

Indicators of Compromise (1)

CVE (1)
CVE-2026-6139
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Apr 13, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-104803 — The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in ...

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation i

CVE-2026-104803
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-104801 — The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress i...

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is

CVE-2026-104801
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-97670 — The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization b...

The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data toke

CVE-2026-97670
NIST NVD