308 matches found
NUUO Camera <=20250203 - OS Command Injection
NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. id: CVE-2025-1338 info: name: NUUO Camera =20250203 - OS Command Injection author: Ark...
AVTECH DVR - Login Verification Code Bypass
AVTECH DVR products are vulnerable to verification code bypass just by entering the "login=quick" parameter to bypass verification code. id: CVE-2013-4982 info: name: AVTECH DVR - Login Verification Code Bypass author: ritikchaddha severity: low description: | AVTECH DVR products are vulnerable t...
EUVD-2026-84985
OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr...
EUVD-2026-84984
OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a...
EUVD-2026-84983
OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the...
EUVD-2026-84982
OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...
CVE-2026-94367
OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376 is vulnerable to an OS command injection in the recbackup component. An authenticated administrator can provide crafted backup-area configuration input that is passed to a shell command, enabling the execution of arbitrary comma...
CVE-2026-92930
OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 (and versions dating back to at least 2.2.3.4 ) contains a vulnerability in the administrator password-reset unlock-code design. Because the system lacks a per-device secret or server-side cryptographic material, an attacker with physic...
CVE-2026-92929
The OpenEye Apex Network Video Recorder (NVR) firmware, specifically version 3.2.9.376 , is vulnerable to an authentication bypass. The software incorrectly trusts the X-Forwarded-For header provided by clients to determine the request source address. This design flaw, present since at least firm...
CVE-2026-92928
The OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be modified, disabled, or rotated. This design flaw, present since at least firmware 2.2.3.4 , allows an unauthenticated remote attacke...
CVE-2026-88622
NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handleimportprivilege.php...
CVE-2026-88623
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...
EUVD-2026-82974
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...
CVE-2026-88623
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...
EUVD-2026-82975
NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handleimportprivilege.php...
CVE-2026-88623
The NUUO Network Video Recorder 2.0.0 is vulnerable to an arbitrary file read flaw located in the up.php component. The issue occurs because the application accepts a user-supplied url parameter via POST and uses the fopen() function to open the URL in binary read-only mode. The resulting content...
CVE-2026-88622
NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handleimportprivilege.php...
CVE-2026-88622
NUUO Network Video Recorder version 2.0.0 is affected by a Command Injection vulnerability in handle_import_privilege.php . The SSVCE assessment rates exploitation at PoC level, automatable, with total technical impact, and a reference Gist (https://gist.github.com/4o3-f0fb1dd3n/b03b435a7c6730a0c...
PT-2026-56465
Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/service endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and...
