Lucene search
+L

168 matches found

Kitploit
Kitploit
added 2026/09/12 11:01 a.m.5 views

traccar

Traccar Overview Traccar is an open source GPS tracking system. This repository contains Java-based back-end service. It supports more than 200 GPS protocols and more than 2000 models of GPS tracking devices. Traccar can be used with any major SQL database system. It also provides easy to use RES...

6AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/12 5:02 a.m.7 views

CVE-2024-24809-Proof-of-concept

CVE-2024-24809 Detail Description Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by...

8.5CVSS8.2AI score0.54413EPSS
SaveExploits9
Kitploit
Kitploit
added 2026/09/10 12:27 p.m.9 views

CVE-2025-68930

🔍 Análisis del CVE-2025-68930: Vulnerabilidad de Secuestro de WebSockets en Traccar El CVE-2025-68930 expone una vulnerabilidad crítica de Cross-Site WebSocket Hijacking CSWSH en Traccar , el sistema de rastreo GPS de código abierto. A continuación, los detalles clave: 🛡️ Detalles de la...

7.1CVSS5.8AI score0.00541EPSS
SaveExploits4
Nuclei
Nuclei
added 2026/09/10 4:50 a.m.66 views

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

8.5CVSS8.4AI score0.54413EPSS
SaveExploits9References3
CVE
CVE
added 2026/06/16 10:19 p.m.53 views

CVE-2026-48745

CVE-2026-48745 – Traccar Client : A vulnerability in Traccar Client

9.3CVSS5.2AI score0.00323EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/16 10:19 p.m.14 views

CVE-2026-48745 Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The...

9.3CVSS5.9AI score
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/06/05 7:33 p.m.13 views

CVE-2026-27694

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store...

5.4CVSS5.5AI score0.00162EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/06/05 7:33 p.m.20 views

CVE-2026-27644

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported...

6.5CVSS5.6AI score0.00228EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/06/05 7:25 p.m.18 views

CVE-2026-44314

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS5.5AI score0.00185EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/05/30 12:00 a.m.32 views

PT-2026-45077

Name of the Vulnerable Software and Affected Versions Traccar Client versions prior to 9.7.20 Description The application registers a custom org.traccar.client://config deep-link scheme that allows the silent modification of persistent configuration settings without user confirmation or...

9.3CVSS5.3AI score0.00323EPSS
SaveExploits0References6
NVD
NVD
added 2026/05/26 5:16 p.m.30 views

CVE-2026-44314

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS0.00185EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/05/26 4:02 p.m.16 views

CVE-2026-44314

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS5.8AI score0.00185EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/05/26 4:02 p.m.21 views

EUVD-2026-31852

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS5.8AI score0.00185EPSS
SaveExploits0References1
OSV
OSV
added 2026/05/26 4:02 p.m.14 views

CVE-2026-44314 Traccar: Missing edit authorization on device image upload allows read-only users to write files

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS6AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/05/26 4:02 p.m.54 views

CVE-2026-44314 Traccar: Missing edit authorization on device image upload allows read-only users to write files

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS0.00185EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/05/26 4:02 p.m.14 views

CVE-2026-44314 Traccar: Missing edit authorization on device image upload allows read-only users to write files

Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.PermissionUser.class, getUserId, Device.class and then immediately streams the uploaded body into mediaManager.createFileStream.... Unlike the generic...

5.3CVSS5.8AI score0.00185EPSS
SaveExploits0References1
CVE
CVE
added 2026/05/26 4:02 p.m.41 views

CVE-2026-44314

CVE-2026-44314 (Traccar) affects the open-source GPS tracking system prior to version 6.13.0. In DeviceResource.uploadImage, authentication is insufficient: after authorizing a target device via Condition.Permission(User.class, getUserId(), Device.class), the route streams the upload into mediaMa...

5.3CVSS5.8AI score0.00185EPSS
SaveExploits0References1Affected Software1
CNNVD
CNNVD
added 2026/05/26 12:00 a.m.22 views

Traccar 安全漏洞

Traccar is a Java-based website building system provided by the American company Traccar. This software supports over 170 GPS protocols and over 1,500 types of GPS tracking devices. Traccar can be used alongside any major SQL database systems. It also offers a user-friendly REST API. Prior to...

5.3CVSS5.9AI score0.00185EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/05/26 12:00 a.m.21 views

PT-2026-43299

Name of the Vulnerable Software and Affected Versions Traccar versions prior to 6.13.0 Description An authorization bypass exists in the GPS tracking system where the 'DeviceResource.uploadImage' endpoint fails to invoke the permissionsService.checkEdit function. While the system uses...

5.3CVSS5.8AI score0.00185EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/05/06 2:21 p.m.13 views

CVE-2026-27693

Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML...

5.4CVSS5.8AI score0.00183EPSS
SaveExploits1References1
Rows per page
Query Builder