CVE-2026-54206 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

EUVD-2026-54436

Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled...

xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

...

CVE-2026-49005

The root password hash of the device can be obtained through unencrypted information in the firmware...

CVE-2024-28000 — Updated!

CVE-2024-28000 - LiteSpeed Cache Privilege Escalation PoC !WARNING This repository is intended for educational and research purposes only. Use the provided PoC exclusively on systems you own or have explicit permission to test. Unauthorized access , exploitation, or misuse of any material in this...

CVE-2026-49005

CVE-2026-49005 affects ZTE F689 devices, where the root password hash can be obtained from unencrypted firmware information. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) yields a LOW base score (2.4), indicating limited impact to confidentiality. The description confirms leakage of t...

EUVD-2026-54357

The root password hash of the device can be obtained through unencrypted information in the firmware...

CVE-2026-49005 Root password hash exposure vulnerability in ZTE F689 product

The root password hash of the device can be obtained through unencrypted information in the firmware...

CVE-2026-49005 Root password hash exposure vulnerability in ZTE F689 product

The root password hash of the device can be obtained through unencrypted information in the firmware...

CVE-2026-49005

The root password hash of the device can be obtained through unencrypted information in the firmware...

OESA-2026-3254 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

CVE-2026-49005: Use of Password Hash With Insufficient Computational Effort

The root password hash of the device can be obtained through unencrypted information in the firmware...

PT-2026-68901

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The link storing functionality at the endpoint '//ServerClient celink.htm' accepts a pathname parameter that can be set to network locations using UNC paths. The server processes these paths...

PT-2026-68902

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox sending functionality for email, fax, and SMS accepts a @@INCLUDE command that can be configured with network locations using UNC paths. The server processes these paths without...

CVE-2026-54205: Improper Input Validation

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

PT-2026-68849

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The root password hash of the device can be obtained through unencrypted information stored within the firmware. Recommendations At the moment, there is no...

PT-2026-68903

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The move archive functionality !ArcEntryMove in the Webbox component processes the pathname parameter without proper validation. This allows an attacker to provide arbitrary paths, including...

PT-2026-68900

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The search functionality of the Webbox component allows unauthenticated users to provide a pathnameroot parameter containing Universal Naming Convention UNC paths. Because the server does not...

CVE-2026-54204: Improper Input Validation

Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled...

CVE-2026-54207: Improper Input Validation

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...