CVE-2026-5204

A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

• CWE-119
• CWE-121
• CWE-787

• https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_49/README.mdExploit, Third Party Advisory
• https://vuldb.com/submit/780209Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/354332Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/354332/ctiPermissions Required, VDB Entry
• https://www.tenda.com.cn/Product

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52001An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a…
• CVE-2026-5201A flaw was found in the gdk-pixbuf library. This heap-based …7.5
• CVE-2026-52021An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) all…7.5
• CVE-2026-52022An issue in kamailio v.6.1.1 and before allows a remote atta…7.5
• CVE-2026-52023An issue in kamailio v.6.1.1 and before allows a remote atta…7.5
• CVE-2026-5203A vulnerability was found in CMS Made Simple up to 2.2.22. T…4.7
• CVE-2026-5205A vulnerability was identified in chatwoot up to 4.11.2. Aff…6.3
• CVE-2026-5206A security vulnerability has been detected in code-projects …6.3
• CVE-2026-5207The LifterLMS plugin for WordPress is vulnerable to SQL Inje…6.5
• CVE-2026-5208Command injection in alerts in CoolerControl/coolercontrold …7.2
• CVE-2026-5209A security vulnerability has been detected in SourceCodester…2.4
• CVE-2026-52097An issue in AppFlowy 0.11.8 allows a remote attacker to exec…6.8