CVE-2025-5542

A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108. It has been classified as problematic. Affected is an unknown function of the file /boafrm/formPortFw of the component Virtual Server Page. The manipulation of the argument service_type leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

• CWE-79
• CWE-94
• CWE-79

• https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/X2000R/XSS_Virtual_ServerExploit
• https://vuldb.com/?ctiid.310992Permissions Required, VDB Entry
• https://vuldb.com/?id.310992Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.585726Third Party Advisory, VDB Entry
• https://www.totolink.net/Product
• https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/X2000R/XSS_Virtual_ServerExploit

Published

Jun 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55383Moss before v0.15 has a file upload vulnerability. The "uplo…8.6
• CVE-2025-5539The Simple Contact Form Plugin for WordPress – WP Easy Conta…6.4
• CVE-2025-55398An issue was discovered in mouse07410 asn1c thru 0.9.29 (202…9.8
• CVE-2025-5540The Event RSVP and Simple Event Management Plugin plugin for…5.4
• CVE-2025-55409FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability …8.8
• CVE-2025-5541The Runners Log plugin for WordPress is vulnerable to Stored…6.4
• CVE-2025-55420A Reflected Cross Site Scripting (XSS) vulnerability was fou…8.8
• CVE-2025-55422In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (…8.8
• CVE-2025-55423A command injection vulnerability exists in the upnp_relay()…9.8
• CVE-2025-5543A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726…4.8
• CVE-2025-5544A vulnerability was found in aaluoxiang oa_system up to 5b44…7.5
• CVE-2025-55443Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive ad…9.1