CVE-2025-14286

A vulnerability was determined in Tenda AC9 15.03.05.14_multi. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/DownloadCfg.jpg of the component Configuration File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

• CWE-200
• CWE-284

• https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN11.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.334874Permissions Required, VDB Entry
• https://vuldb.com/?id.334874Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.702723Third Party Advisory, VDB Entry
• https://www.tenda.com.cn/Product
• https://github.com/Madgeaaaaa/MY_VULN_2/blob/main/Tenda/VULN11.mdExploit, Third Party Advisory

Published

Dec 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14280The PixelYourSite plugin for WordPress is vulnerable to Sens…5.3
• CVE-2025-14281Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-14282A flaw was found in Dropbear. When running in multi-user mod…5.4
• CVE-2025-14283The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks …6.4
• CVE-2025-14284Versions of the package @tiptap/extension-link before 2.10.4…6.1
• CVE-2025-14285A vulnerability was found in code-projects Employee Profile …9.8
• CVE-2025-14287A command injection vulnerability exists in mlflow/mlflow ve…8.8
• CVE-2025-14288The Gallery Blocks with Lightbox. Image Gallery, (HTML5 vide…4.3
• CVE-2025-14289IBM webMethods Integration Server 12.0 is vulnerable to HTML…5.4
• CVE-2025-1429A maliciously crafted MODEL file, when parsed through Autode…7.8
• CVE-2025-14290IBM webMethods Integration (on prem) -Integration Server 10.…5.4
• CVE-2025-14293The WP Job Portal plugin for WordPress is vulnerable to Arbi…6.5