CVE-2018-10166

The CVE-2018-10166 issue affects TP-Link EAP Controller and Omada Controller (versions 2.5.4_Windows / 2.6.0_Windows). The web management interface lacks Anti-CSRF tokens in forms, enabling authenticated actions from a user visiting a controlled domain. Core Security details confirm PoCs: ability...

CVE-2018-10164

Summary: CVE-2018-10164 is a stored XSS vulnerability in TP-Link EAP Controller and Omada Controller. Affected versions are 2.5.4_Windows and 2.6.0_Windows. The issue arises via portalPictureUpload, enabling an authenticated attacker to inject arbitrary web script/HTML. TP-Link fixed the flaw in ...

CVE-2018-10165

Stored Cross-site scripting XSS vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4Windows/2.6.0Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version...