47 matches found
Tasmota 安全漏洞
Tasmota is an IoT device firmware and automation control platform developed by Theo Arends. Versions of Tasmota prior to 15.3.0.3 contained security vulnerabilities. These vulnerabilities stemmed from the fetchjpg function in xdrv10scripter.ino, which stored the Content-Length of JPEG streams in ...
PT-2026-43711
An issue in fetch jpg in xdrv 10 scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow. The Content-Length from a JPEG stream is stored in a uint16 t variable; values above 65535 wrap around, causing allocation of a smaller buffer than the data actually...
CVE-2026-38426
The CVE-2026-38426 issue affects Arendst Tasmota, v15.3.0.3 and earlier, via the xdrv_10_scripter.ino fetch_jpg()/jpg_task.boundary[40] path. A strcpy() overrun of boundary[40] can corrupt adjacent fields, including vtable pointers for WiFiClient/HTTPClient, enabling remote code execution on ESP3...
PT-2026-43710
Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv 10 scripter.ino, fetch jpg, jpg task.boundary40, strcpy function...
Exploit for CVE-2026-38427
CVE-2026-38427: Integer Wraparound → Heap Buffer Overflow in T...
Exploit for CVE-2026-38426
CVE-2026-38426: strcpy Stack Buffer Overflow in Tasmota fetc...
Exploit for CVE-2026-38422
CVE-2026-38422: Remote Code Execution via Combined Buffer Over...
EUVD-2021-23200
Malware in sbrugna...
EUVD-2022-46338
Malicious code in bioql PyPI...
CVE-2022-43294
Tasmota before commit 066878da4d4762a9b6cb169fdf353e804d735cfd was discovered to contain a stack overflow via the ClientPortPtr parameter at lib/libesp32/rtsp/CRtspSession.cpp...
CVE-2021-36603
Cross Site Scripting XSS in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Friendly Name 1"...
CVE-2021-36603
Cross Site Scripting XSS in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Friendly Name 1"...
CVE-2021-36603
Cross Site Scripting XSS in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Friendly Name 1"...
Cross site scripting
Cross Site Scripting XSS in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Friendly Name 1"...
CVE-2021-36603
Cross Site Scripting XSS in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Friendly Name 1"...
CVE-2021-36603
Cross Site Scripting XSS in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Friendly Name 1"...
Tasmota 跨站脚本漏洞
Tasmota is a replacement firmware for the ESP8266 with easy configuration using the webUI, OTA updates, automation using timers or rules, scalability, and full local control over MQTT, HTTP, serial or KNX. A security vulnerability exists in Tasmota firmware version 6.5.0 that could allow a remote...
PT-2023-12293 · Tasmota · Tasmota
Name of the Vulnerable Software and Affected Versions: Tasmota firmware version 6.5.0 Description: The issue allows remote attackers to inject JavaScript code via a crafted string in the Friendly Name 1 field. This enables Cross Site Scripting XSS attacks. Recommendations: For Tasmota firmware...
CVE-2021-36603
CVE-2021-36603 affects Tasmota firmware 6.5.0. An XSS flaw in the Friendly Name 1 field allows remote attackers to inject JavaScript via a crafted value, potentially compromising user browsers. Root cause: unsafe handling of user-supplied input in that field. Impact: described as XSS; no exploita...