CVE-2026-54212 TeamDavid: Buffer Overflow in JSON-parsing

Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON body, such as one that is at least 8 characters long and begins with a number, an unauthenticated attacker can cause the server...

CVE-2026-54212 TeamDavid: Buffer Overflow in JSON-parsing

Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON body, such as one that is at least 8 characters long and begins with a number, an unauthenticated attacker can cause the server...

EUVD-2026-54443

Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON body, such as one that is at least 8 characters long and begins with a number, an unauthenticated attacker can cause the server...

CVE-2026-54212

CVE-2026-54212 affects Tobit Laboratories AG TeamDavid’s Webbox — an API endpoint is vulnerable to a buffer overflow in JSON parsing. A crafted JSON body (e.g., ≥8 chars starting with a number) can crash the server, causing denial of service and, depending on stack state or potential stack canary...

CVE-2026-54211 TeamDavid: Buffer Overflow in multiple form data parameters

Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClientclose.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting ...

CVE-2026-54211

CVE-2026-54211 affects Tobit Laboratories AG TeamDavid's Webbox: endpoint //serverClient_close.html vulnerable to a buffer overflow in multiple form data parameters. Submitting excessively long values can crash the server, causing denial of service. Depending on stack state or if a stack canary i...

CVE-2026-54210

Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in ...

EUVD-2026-54440

Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "editini" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refer...

CVE-2026-54209 TeamDavid: Buffer Overflow in 'editini' function

Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "editini" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refer...

CVE-2026-54209

Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "editini" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refer...

CVE-2026-54209 TeamDavid: Buffer Overflow in 'editini' function

Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "editini" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refer...

CVE-2026-54208 TeamDavid: Arbitrary File Write leading to Stored XSS

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...

EUVD-2026-54439

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...

CVE-2026-54208

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...

CVE-2026-54208 TeamDavid: Arbitrary File Write leading to Stored XSS

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper...

CVE-2026-54208

The CVE affects Tobit Laboratories AG TeamDavid’s Webbox. An unauthenticated attacker can exploit an arbitrary file-write flaw (via unsafely written user input) to create/write files (e.g., .htm) containing JavaScript, triggering stored XSS when a user accesses the file. The issue affects TeamDav...

EUVD-2026-54438

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54207 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54206

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54204 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionality

Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled...