Most recent entries from all

cnvd-2018-09302

2026-10-06T13:44:01.263565+00:00

cnvd-2018-09302

fkie_cve-2018-10165

2026-10-06T13:44:01.263676+00:00

GHSA-3pm5-qmcr-c546

2026-10-06T13:44:01.263753+00:00

gsd-2018-10165

2026-10-06T13:44:01.263786+00:00

gsd-2018-10165

VAR-201805-0359

2026-10-06T13:44:01.263807+00:00

Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version 2.6.1_Windows. TP-Link EAP Controller and Omada Controller Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. A privilege-escalation vulnerability 2. A hard-coded cryptographic key vulnerability 3. A cross-site request-forgery vulnerability 4. Multiple HTML-injection vulnerability An attacker may leverage these issues to gain elevated privileges, perform unauthorized actions and gain access to the affected application, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. **Advisory Information**

Title: TP-Link EAP Controller Multiple Vulnerabilities Advisory ID: CORE-2018-0001 Advisory URL: http://www.coresecurity.com/advisories/tp-link-eap-controller-multiple-vulnerabilities Date published: 2018-05-03 Date of last update: 2018-04-17 Vendors contacted: TP-Link Release mode: Coordinated release

2. **Vulnerability Information**

Class: Improper Privilege Management [CWE-269], Use of Hard-coded Cryptographic Key [CWE-321], Cross-Site Request Forgery [CWE-352], Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') [CWE-79], Improper Neutraliz…