CVE-2014-7860

The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album_id and access_token.

• CWE-200
• CWE-287

• http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/May/125Mailing List, Third Party Advisory, VDB Entry
• http://www.search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdfTechnical Description
• http://www.securityfocus.com/archive/1/535626/100/200/threaded
• http://www.securityfocus.com/bid/74884Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/May/125Mailing List, Third Party Advisory, VDB Entry
• http://www.search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdfTechnical Description
• http://www.securityfocus.com/archive/1/535626/100/200/threaded
• http://www.securityfocus.com/bid/74884Third Party Advisory, VDB Entry

Published

Aug 25, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-7854Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-7855Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-7856Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-7857D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.0…
• CVE-2014-7858The check_login function in D-Link DNR-326 before 2.10 build…
• CVE-2014-7859Stack-based buffer overflow in login_mgr.cgi in D-Link firmw…
• CVE-2014-7861The IOHIDSecurePromptClient function in Apple OS X does not …
• CVE-2014-7862The DCPluginServelet servlet in ManageEngine Desktop Central…
• CVE-2014-7863The FailOverHelperServlet (aka FailServlet) servlet in ZOHO …7.5
• CVE-2014-7864Multiple SQL injection vulnerabilities in the FailOverHelper…
• CVE-2014-7865Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-7866Multiple directory traversal vulnerabilities in ZOHO ManageE…