traccar

Traccar Overview Traccar is an open source GPS tracking system. This repository contains Java-based back-end service. It supports more than 200 GPS protocols and more than 2000 models of GPS tracking devices. Traccar can be used with any major SQL database system. It also provides easy to use RES...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2025-68930

🔍 Analysis of CVE-2025-68930: WebSocket Hijacking Vulnerability in Traccar The CVE-2025-68930 exposes a critical Cross-Site WebSocket Hijacking CSWSH vulnerability in Traccar , the open-source GPS tracking system. Below are the key details: 🛡️ Vulnerability Details Affected endpoint : /api/socket...

CVE-2024-24809-Proof-of-concept

CVE-2024-24809 Detail Description Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by...

CVE-2026-108737

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change...

CVE-2026-108738

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

CVE-2026-108738 Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

EUVD-2026-96904

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

CVE-2026-108738

The Traccar application (versions 5.7 through 6.16.0 ) is vulnerable to a Login CSRF attack via the OpenID Connect callback. The root cause is that the application fails to validate the OAuth state parameter during the callback process. An attacker can force a victim's browser to load the /api/se...

CVE-2026-108738 Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

CVE-2026-108737 Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change...

CVE-2026-108737 Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change...

CVE-2026-108737

Versions of Traccar through 6.16.0 are vulnerable to a weak password recovery flaw due to token purpose confusion in the TokenManager component. Because the system fails to bind tokens to a specific purpose, an attacker who obtains a leaked password reset link can reuse that token to establish a ...

EUVD-2026-96903

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change...

CVE-2026-108738: Cross-Site Request Forgery (CSRF)

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

PT-2026-110140

🚨 CVE-2026-108737 Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via...

CVE-2026-108737: Weak Password Recovery Mechanism for Forgotten Password

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change...

PT-2026-110141

Name of the Vulnerable Software and Affected Versions Traccar versions 5.7 through 6.16.0 Description A cross-site request forgery issue exists where the OpenID Connect callback fails to validate the OAuth state parameter. This allows an attacker to force a victim to log into an account controlle...

CVE-2026-106450 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, apache-nifi, logstash, elasticsearch, kayenta, flink-kubernetes-operator-fips, wazuh-indexer, apache-polaris-fips, apache-pulsar-fips, flink-kubernetes-operator, apache-polaris, kafbat-ui, confluent-kafka-jre-bcfips, opensearch-fips, kafka-fip...

GHSA-343H-94H5-C4WR vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, apache-nifi, logstash, elasticsearch, kayenta, flink-kubernetes-operator-fips, wazuh-indexer, apache-polaris-fips, apache-pulsar-fips, flink-kubernetes-operator, apache-polaris, kafbat-ui, confluent-kafka-jre-bcfips, opensearch-fips, kafka-fip...