CVE-2025-15047

CriticalCVSS 9.8/10Last modified Oct 19, 2026

Description

A vulnerability was found in Tenda WH450 1.0.0.18. This affects an unknown function of the file /goform/PPTPDClient of the component HTTP Request Handler. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

No affected versions have been published.

Timeline

Published: Dec 23, 2025
Last modified: Oct 19, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-150489.8A vulnerability was determined in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/CheckTools of the component HTT CVE-2025-150499.8A vulnerability was identified in code-projects Online Farm System 1.0. Affected is an unknown function of the file /addProduct.php. The man CVE-2025-15056.1The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all vers CVE-2025-150508.8A security vulnerability has been detected in code-projects Student File Management System 1.0. This affects an unknown part of the file /sa CVE-2025-150515.4IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr CVE-2025-150525.4A vulnerability was detected in code-projects Student Information System 1.0. This vulnerability affects unknown code of the file /profile.p CVE-2025-150537.3A flaw has been found in code-projects Student Information System 1.0. This issue affects some unknown processing of the file /searchresults CVE-2025-150557.2The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' and 'resource' parameters in all ve CVE-2025-150566.1A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill:CVE-2025-150577.2The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fh` (fingerprint) parameter in all version CVE-2025-150586.4The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'table_currency' parameter in all ver CVE-2025-150597.8GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute