32 matches found
CVE-2026-44886 Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to...
CVE-2026-44886
Pi.Alert’s web interface is vulnerable to unauthenticated blind SQL injection in the /pialert/php/server/devices.php endpoint when action=getDevicesTotals is used and the scansource parameter is injected. From 2024-06-29 until 2026-05-07, unauthenticated users could trigger the vulnerability; the...
CVE-2026-44886 Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to...
CVE-2026-44886: Improper Neutralization of Special Elements used in an SQL Command
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL injection. The /pialert/php/server/devices.php route accepts requests from unauthenticated users when the action URL parameter is set to...
PT-2026-44074
Name of the Vulnerable Software and Affected Versions Pi.Alert versions prior to 2026-05-07 Description Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. The web application endpoint '/pialert/php/server/devices.php' allows unauthenticated users to perform SQL injection when...
EUVD-2018-8834
Malware in sbrugna...
CVE-2020-25352
A stored cross-site scripting XSS vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote attackers to perform arbitrary Javascript execution through entering a crafted payload into the 'Model' field then saving...
CVE-2020-25352
A stored cross-site scripting XSS vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote attackers to perform arbitrary Javascript execution through entering a crafted payload into the 'Model' field then saving...
PT-2021-11128
Name of the Vulnerable Software and Affected Versions: inrConfig versions 3.9.5 Description: A stored cross-site scripting XSS issue in the /devices.php function allows remote attackers to execute arbitrary Javascript by entering a crafted payload into the Model field and saving. This enables...
CVE-2020-25352: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote attackers to perform arbitrary Javascript execution through entering a crafted payload into the 'Model' field then saving...
CVE-2020-15713
rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.php script using the sortBy parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database...
PT-2020-14600
Name of the Vulnerable Software and Affected Versions rConfig version 3.9.5 Description The issue allows a remote authenticated attacker to send crafted SQL statements to the "devices.php" script using the sortBy parameter. This could enable the attacker to view, add, modify, or delete informatio...
CVE-2020-15713: Improper Neutralization of Special Elements used in an SQL Command
rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.php script using the sortBy parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database...
CVE-2020-15037
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...
Cross site scripting
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...
CVE-2020-15037
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...
CVE-2020-15037
The CVE-2020-15037 entry concerns NeDi 1.9C, a web application where an attacker can inject arbitrary JavaScript through the Reports-Devices.php page via the st[] parameter, causing a cross-site scripting (XSS) vulnerability. The consolidated connected documents confirm the vulnerability exists i...
PT-2020-14138
Name of the Vulnerable Software and Affected Versions NeDi version 1.9C Description The issue allows an attacker to execute arbitrary JavaScript code via the "Reports-Devices.php" page st parameter, enabling a cross-site scripting XSS attack. Recommendations For NeDi version 1.9C, as a temporary...
CVE-2020-15037: Improper Neutralization of Input During Web Page Generation
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...