CVE-2024-26521

HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...

PT-2024-21273 · Phoenix Contact · Charx Sec-3100

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 affected versions not specified Description: An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful...

CE Phoenix Cart Security Vulnerability

CE Phoenix Cart is a free, open source e-commerce shopping cart software from CE Phoenix Cart Open Source. A security vulnerability exists in CE Phoenix Cart v1.0.8.20 and earlier versions, which stems from the presence of an HTML injection vulnerability. The vulnerability can be exploited by an...

CVE-2024-26521

CE Phoenix (e-commerce software), version v1.0.8.20 and earlier , contains an HTML Injection vulnerability in the english.php component. The root cause is the insufficient neutralization of special characters , which allows a remote attacker to use a crafted payload to execute arbitrary code , es...

PT-2024-21271

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 affected versions not specified Description An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user. Recommendations At...

PT-2024-21276

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 CANopenDevice affected versions not specified Description An unauthenticated remote attacker can disrupt the charging functionality by causing a denial-of-service DoS in the control agent due to access of an...

PT-2024-21272

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 affected versions not specified Description An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected. Recommendations At the moment, the...

PT-2024-21275

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 affected versions not specified Description An unauthenticated remote attacker can cause a denial of service DoS to the control agent due to an out-of-bounds read, which may prevent or disrupt the charging...

PT-2024-21270 · Phoenix Contact · Charx Sec-3100 Charxupdateagent

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 CharxUpdateAgent affected versions not specified Description: An unauthenticated remote attacker can upload an arbitrary script file due to improper input validation. The upload destination is fixed and is write...

CVE-2024-26521: Improper Neutralization of Input During Web Page Generation

HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the english.php component...

PT-2024-21334

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3100 affected versions not specified Description An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a Man-In-The-Middle MITM attack. Charging is not...

CVE-2024-25415

A remote code execution RCE vulnerability in /admin/definelanguage.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php...

Remote code execution

A remote code execution RCE vulnerability in /admin/definelanguage.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php...

CVE-2024-25415

A remote code execution RCE vulnerability in /admin/definelanguage.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php...

CVE-2024-25415

A remote code execution RCE vulnerability in /admin/definelanguage.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php...

CVE-2024-25415

A remote code execution RCE vulnerability in /admin/definelanguage.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php...

CE Phoenix Cart Security Vulnerability

CE Phoenix Cart is a free, open source e-commerce shopping cart software from CE Phoenix Cart Open Source. A security vulnerability exists in CE Phoenix Cart v1.0.8.20, which originates from a Remote Code Execution RCE vulnerability in component /admin/definelanguage.php...

CVE-2024-25415

CVE-2024-25415 is an RCE affecting CE Phoenix v1.0.8.20 via /admin/define_language.php, enabling arbitrary PHP code execution by injecting a crafted payload into english.php. Multiple sources confirm the issue and link to public PoCs/exploits, with CVSS v3.1 scores: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:...

CVE-2024-25415: Improper Control of Generation of Code

A remote code execution RCE vulnerability in /admin/definelanguage.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php...

Samly security breach

Samly is used to enable the Plug/Phoenix application via SAML. A security vulnerability exists in Samly versions prior to 1.4.0, which stems from the ability to return expired sessions, which can interfere with access control...