GeoVision GeoWebServer <= 5.3.3 - Local File Inclusion / Cross-Site Scripting

GeoVision GeoWebServer 5.3.3 and prior is vulnerable to local file inclusion and cross-site scripting due to improper sanitization of user-supplied input in the WebStrings.srf endpoint. An unauthenticated attacker can read arbitrary files from the server or inject malicious scripts. id:...

CVE-2025-26263

CVE-2025-26263 CVE-2025-26263 - GeoVision ASManager Windows 桌面应用程序（版本 6.1.2.0 或更低版本）存在凭据泄露漏洞，原因是 ASManagerService.exe 进程中的内存处理不当。 要求 要成功实施攻击，攻击者需要： 对 GV-ASManager Windows 桌面应用程序（版本 6.1.2.0 或更低版本）具有系统级访问权限； 拥有高权限账户以转储内存。 影响 该漏洞可被利用来执行以下未经授权的操作 ： 拥有高权限系统用户但未被授权访问 GeoVision ASManager 的攻击者能够： 转储...

CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb（版本 6.1.2.0 或更低版本）的“通知设置”功能中存在一个远程代码执行（RCE）漏洞。具有 ASWeb “系统设置”权限的已认证攻击者可以利用此漏洞在服务器上执行任意命令，从而导致系统完全受损。 要求 要成功实施攻击，攻击者需要： 能够访问版本为 6.1.2.0 或更低版本的 GV-ASManager Web 应用程序； 能够访问具有管理通知设置功能权限的账户。 影响 该漏洞可被利用来执行以下未经授权的操作 ： 拥有管理通知设置功能权限的账户能够： 执行远程代码执行攻击。...

CVE-2026-92838

A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location. If...

CVE-2026-92838 GeoVision GV-Remote E-Map dll hijacking vulnerability

A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location. If...

CVE-2026-92838 GeoVision GV-Remote E-Map dll hijacking vulnerability

A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location. If...

EUVD-2026-81314

A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location. If...

CVE-2026-92838

A DLL hijacking vulnerability in the GeoVision GV-Remote E-Map desktop application allows a local attacker to place a malicious DLL in a directory searched before the legitimate library location, achieving arbitrary code execution in the context of the GV-Remote E-Map process. Exploitation requir...

CVE-2026-92838: Uncontrolled Search Path Element

A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location. If...

CVE-2026-88290

GeoVision GV-LPC2211 V1.14 260903 allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources...

CVE-2026-88289

GeoVision GV-LPC2211 V1.14 260903 fails to validate attacker-controlled variable-length fields before copying them into fixed-size stack buffers in multiple VLSVR request handlers, allowing an unauthenticated remote attacker to crash the VLSVR service...

CVE-2026-88288

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...

CVE-2026-88282

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

CVE-2026-88281

GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests, allowing an authenticated administrator to overflow a stack array and crash the ONVIF worker...

CVE-2026-88285

GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands...

CVE-2026-88284

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker...

CVE-2026-88280

GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allowing an authenticated administrator to crash the ONVIF worker...

CVE-2026-88286

GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remote client to block the accept loop and prevent new PTZ connections...

CVE-2026-88287

GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Discovery Probe requests, allowing a remote attacker to corrupt stack control state and crash the discovery process...

CVE-2026-88283

GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allowing an authenticated administrator to overwrite stack control state and crash the ONVIF worker...