CVE-2025-2811

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Beryl AX, GL-MT6000 Flint 2, GL-SFT1200 Opal, GL-X300B Collie, GL-X750 Spitz, GL-X3000 Spitz AX, GL-XE300 Puli and GL-XE3000 Puli AX 4.x. It has been declared as problematic. This vulnerability affects unknown code of the component API. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component.

• CWE-400
• CWE-1333

• https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn't%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md
• https://vuldb.com/?ctiid.306286
• https://vuldb.com/?id.306286
• https://vuldb.com/?submit.524459
• https://www.gl-inet.com/security-updates/security-advisories-vulnerabilities-and-cves-apr-24-2025/
• https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Calling%20a%20special%20API%20that%20doesn't%20require%20login%20and%20passing%20in%20a%20special%20character%20parameter%20results%20in%20100%25%20CPU%20usage.md

Published

Apr 26, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2810A low privileged local attacker can abuse the affected servi…5.5
• CVE-2025-28100A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a…9.8
• CVE-2025-28101An arbitrary file deletion vulnerability in the /post/{postT…6.5
• CVE-2025-28102A cross-site scripting (XSS) vulnerability in flaskBlog v2.6…6.1
• CVE-2025-28103Incorrect access control in laskBlog v2.6.1 allows attackers…6.4
• CVE-2025-28104Incorrect access control in laskBlog v2.6.1 allows attackers…9.1
• CVE-2025-2812Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2025-28121code-projects Online Exam Mastering System 1.0 is vulnerable…6.1
• CVE-2025-28128An issue in Mytel Telecom Online Account System v1.0 allows …7
• CVE-2025-28129Phpgurukul Hostel Management System 2.1 is vulnerable to cli…5.4
• CVE-2025-2813An unauthenticated remote attacker can cause a Denial of Ser…7.5
• CVE-2025-28131A Broken Access Control vulnerability in Nagios Network Anal…4.6