87 matches found
DRA_writeup
Security vulnerabilities in Oracle DSR KPN CISO REDteam KPN is a telecom operator located in the Netherlands. The CISO REDteam was introduced in 2013 and is KPN’s ethical hacking team. This team is involved in security tests of KPN applications and services to ensure that our customers’ data is...
CVE-2026-52200
UZ801 / ES-U3TS MifiService Control de Acceso Roto Aviso de seguridad y notas técnicas sobre un problema de control de acceso roto en la API de gestión web embebida expuesta por MifiService.apk en la plataforma OEM / marca blanca UZ801v2.1 de Wi-Fi móvil 4G LTE, también comercializada como ES-U3T...
CVE-2026-52199: Improper Neutralization of Special Elements used in a Command
An issue in Generic OEM UZ801v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component...
CVE-2026-52200: Improper Control of Generation of Code
An issue in Generic OEM UZ801v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk...
CVE-2021-47740: Insufficient Session Expiration
KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. Attackers can exploit the weak session handling to maintain unauthorized access and potentially compromise device authentication mechanisms...
CVE-2025-68706: Stack-based Buffer Overflow
A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attack...
CVE-2025-41108: Improper Authentication
The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating the control station tablet and gaining unauthorised full control of the robot. The absence of encryption and authenticati...
EUVD-2019-14912
Malware in sbrugna...
EUVD-2022-34052
Malicious code in bioql PyPI...
EUVD-2024-53553
Malicious code in bioql PyPI...
CVE-2025-57278: Improper Authentication
The LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800B10ALKSLV01.01.02P42U1406 does not implement proper session handling. After a user authenticates from a specific IP address, the router grants access to any other client using that same IP, without requiring credentials or...
CVE-2024-53946: Cross-Site Request Forgery (CSRF)
The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery CSRF on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in...
CVE-2025-29653
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2025-29653
TP-Link M7450 4G LTE Mobile Wi‑Fi Router is affected by CVE-2025-29653 as reported in multiple sources (Red Hat and PT-2025-16890). The vulnerability is a SQL Injection in firmware version 1.0.2 Build 170306 Rel.1015n, exploitable via the username and password fields. The PT-2025-16890 descriptio...
PT-2025-16882 · Tp Link · Tp-Link M7200
Name of the Vulnerable Software and Affected Versions: TP-Link M7200 4G LTE Mobile Wi-Fi Router version 1.0.7 Build 180127 Rel.55998n Description: A SQL Injection issue exists, allowing an unauthenticated attacker to inject malicious SQL statements via the username and password fields. This issue...
PT-2025-16889 · Tp Link · Tp-Link M7000
Name of the Vulnerable Software and Affected Versions: TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware version 1.0.7 Build 180127 Rel.55998n Description: A SQL Injection vulnerability exists in the TP-Link M7000 4G LTE Mobile Wi-Fi Router Firmware, allowing an unauthenticated attacker to inject...
CVE-2024-57238
Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/procget endpoint. The vulnerability allows an attacker to manipulate SQL queries by injecting malicious SQL code into the orderby parameter...