Lucene search
+L

168 matches found

Kitploit
Kitploit
added 2026/09/12 11:01 a.m.5 views

traccar

Traccar Resumen Traccar es un sistema de seguimiento GPS de código abierto. Este repositorio contiene un servicio back-end basado en Java. Es compatible con más de 200 protocolos GPS y más de 2000 modelos de dispositivos de seguimiento GPS. Traccar puede utilizarse con cualquier sistema de base d...

6AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/12 5:02 a.m.7 views

CVE-2024-24809-Proof-of-concept

CVE-2024-24809 详情 描述 Traccar 是一个开源 GPS 跟踪系统。6.0 之前的版本存在路径遍历和危险类型文件无限制上传漏洞。由于系统默认允许注册,攻击者可以通过注册账户获取普通用户权限,并利用此漏洞在任意文件夹下上传以 device. 为前缀的文件。攻击者可利用此漏洞进行钓鱼、跨站脚本攻击,并可能在服务器上执行任意命令。版本 6.0 包含针对此问题的补丁。 使用 root@kitploit: Fofa 查询 : app="traccar" root@kitploit: nuclei --target target.com -t CVE-2024-24809.yam...

8.5CVSS8.2AI score0.54413EPSS
SaveExploits9
Kitploit
Kitploit
added 2026/09/10 12:27 p.m.9 views

CVE-2025-68930

🔍 CVE-2025-68930 分析:Traccar 中的 WebSocket 劫持漏洞 CVE-2025-68930 暴露了 Traccar (开源 GPS 跟踪系统)中的一个 关键跨站 WebSocket 劫持漏洞(CSWSH) 。以下是关键详情: 🛡️ 漏洞详情 受影响端点 :/api/socket 根本原因 :WebSocket 握手期间 未对Origin 标头进行验证。 利用机制 : 1. 攻击者诱骗已认证用户访问恶意网站。 2. 恶意网站利用用户的活跃会话(JSESSIONID)与 Traccar 服务器建立 WebSocket 连接。 3. 服务器 接受连接...

7.1CVSS5.8AI score0.00541EPSS
SaveExploits4References1
Nuclei
Nuclei
added 2026/09/10 4:50 a.m.66 views

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

8.5CVSS8.4AI score0.54413EPSS
SaveExploits9References3
CVE
CVE
added 2026/06/16 10:19 p.m.53 views

CVE-2026-48745

CVE-2026-48745 – Traccar Client : A vulnerability in Traccar Client

9.3CVSS5.2AI score0.00323EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/16 10:19 p.m.14 views

CVE-2026-48745 Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The...

9.3CVSS5.9AI score
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/06/05 7:33 p.m.13 views

CVE-2026-27694

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store...

5.4CVSS5.5AI score0.00162EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/06/05 7:33 p.m.20 views

CVE-2026-27644

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported...

6.5CVSS5.6AI score0.00228EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/06/05 7:25 p.m.19 views

CVE-2026-44314

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS5.5AI score0.00185EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/05/30 12:00 a.m.32 views

PT-2026-45077

Name of the Vulnerable Software and Affected Versions Traccar Client versions prior to 9.7.20 Description The application registers a custom org.traccar.client://config deep-link scheme that allows the silent modification of persistent configuration settings without user confirmation or...

9.3CVSS5.3AI score0.00323EPSS
SaveExploits0References6
NVD
NVD
added 2026/05/26 5:16 p.m.30 views

CVE-2026-44314

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS0.00185EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/05/26 4:02 p.m.16 views

CVE-2026-44314

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS5.8AI score0.00185EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/05/26 4:02 p.m.14 views

CVE-2026-44314 Traccar: Missing edit authorization on device image upload allows read-only users to write files

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS6AI score
SaveExploits0References3
EUVD
EUVD
added 2026/05/26 4:02 p.m.23 views

EUVD-2026-31852

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS5.8AI score0.00185EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/05/26 4:02 p.m.14 views

CVE-2026-44314 Traccar: Missing edit authorization on device image upload allows read-only users to write files

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS5.8AI score0.00185EPSS
SaveExploits0References1
CVE
CVE
added 2026/05/26 4:02 p.m.41 views

CVE-2026-44314

CVE-2026-44314 (Traccar) affects the open-source GPS tracking system prior to version 6.13.0. In DeviceResource.uploadImage, authentication is insufficient: after authorizing a target device via Condition.Permission(User.class, getUserId(), Device.class), the route streams the upload into mediaMa...

5.3CVSS5.8AI score0.00185EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/05/26 4:02 p.m.55 views

CVE-2026-44314 Traccar: Missing edit authorization on device image upload allows read-only users to write files

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS0.00185EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/05/26 12:00 a.m.22 views

Traccar 安全漏洞

Traccar is a Java-based website building system provided by the American company Traccar. This software supports over 170 GPS protocols and over 1,500 types of GPS tracking devices. Traccar can be used alongside any major SQL database systems. It also offers a user-friendly REST API. Prior to...

5.3CVSS5.9AI score0.00185EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/05/26 12:00 a.m.22 views

PT-2026-43299

Name of the Vulnerable Software and Affected Versions Traccar versions prior to 6.13.0 Description An authorization bypass exists in the GPS tracking system where the 'DeviceResource.uploadImage' endpoint fails to invoke the permissionsService.checkEdit function. While the system uses...

5.3CVSS5.8AI score0.00185EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/05/06 2:21 p.m.13 views

CVE-2026-27693

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML...

5.4CVSS5.8AI score0.00183EPSS
SaveExploits1References1
Rows per page
Query Builder