CVE-2026-115796
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Per
CVSS
4.3
Média
EPSS
0.2%
p5
KEV
—
Exploit Today
2
0-100
Publicado: 23 de out. de 2026 · Última mod.: 29 de out. de 2026 · CWE-352 · CWE-862
0.2%EPSS · 30 dias0.2%
2026-10-252026-11-07
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
- github.comhttps://github.com/0xWKZER/tenda-f6-vulnerabilities/blob/main/01-csrf.md
- vuldb.comhttps://vuldb.com/cve/CVE-2026-115796
- vuldb.comhttps://vuldb.com/submit/1022074
- vuldb.comhttps://vuldb.com/vuln/425974
- vuldb.comhttps://vuldb.com/vuln/425974/cti
- www.tenda.com.cnhttps://www.tenda.com.cn/
- github.comhttps://github.com/0xWKZER/tenda-f6-vulnerabilities/blob/main/01-csrf.md
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1244888.1 ALT—
———OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records.3hCVE-2026-1244868.8 ALT—
———OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.3hCVE-2026-1244848.8 ALT—
———OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.3hCVE-2026-1244808.8 ALT—
———OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.3hCVE-2026-1244786.5 MÉD—
———OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.3hCVE-2026-1244778.8 ALT—
———OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks.3h