PT-2026-66507

Name of the Vulnerable Software and Affected Versions CSL 1010 M2M 3G WiFi Module versions prior to 2.2.1.5 Description The firmware uses a weak single-byte XOR cipher with a static key to obfuscate the configuration backup file. This allows unauthenticated attackers to reverse the cipher and...

CVE-2026-33385

Quick.CMS 6.8 is affected by a Blind SQL injection in the administration panel, resulting from improper neutralization of input fields accessed by a high-privileged user. The vulnerability can bypass front-end validation controls and potentially lead to database destruction. The CVSS-derived metr...

CVE-2026-33385 Blind SQL Injection in Quick.CMS

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

CVE-2026-33385: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for...

Malicious code in vtranalytic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903 The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at...

MAL-2026-11156 Malicious code in vtranalytic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903 The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at...

CradlePoint Gateway - Login Panel Detection

CradlePoint an Ericsson company produces cellular-connected SD-WAN and VPN gateway appliances. The web administration interface is commonly exposed on port 8080. !/usr/bin/env python3 -- coding: utf-8 -- """CradlePoint an Ericsson company produces cellular-connected SD-WAN and VPN gateway...

Adobe Coldfusion - Authentication Bypass Detection

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

i-Panel Administration System 2.0 - Cross-Site Scripting Detection

i-Panel Administration System 2.0 contains a cross-site scripting vulnerability that enables an attacker to execute arbitrary JavaScript code in the browser-based web console. !/usr/bin/env python3 -- coding: utf-8 -- """i-Panel Administration System 2.""" from kittysploit import from...

JBoss jBPM Administration Console Login Panel - Detect

JBoss jBPM Administration Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """JBoss jBPM Administration Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JBo...

FatPipe WARP - Panel Detect

the FatPipe WARP administration panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """the FatPipe WARP administration panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FatPipe WARP -...

Go.Control Event Administration Panel - Detect

Detects the presence of the Go.Control Event Administration login panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of the Go.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Go.Control Event...

Endpoint Protector Login Panel - Detect

Endpoint Protector - Reporting and Administration Tool login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Endpoint Protector - Reporting and Administration Tool login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Hybris Administration Console Login Panel - Detect

Hybris Administration Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Hybris Administration Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hybris...

RethinkDB Administration Console - Detect

RethinkDB Administration Console was detected. !/usr/bin/env python3 -- coding: utf-8 -- """RethinkDB Administration Console was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'RethinkDB Administration...

Radius Manager Admininstration Control Panel Login Panel - Detect

Radius Manager Administration Control Panel login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Radius Manager Administration Control Panel login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Solar-Log 500 2.8.2 - Incorrect Access Control Detection

Solar-Log 500 2.8.2 is susceptible to incorrect access control because the web administration server for Solar-Log 500 all versions prior to 2.8.2 Build 52 does not require authentication, which allows arbitrary remote attackers gain administrative privileges by connecting to the server...

Confluence OAuth Administration Endpoint Detection

Detects Confluence OAuth Administration Endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Confluence OAuth Administration Endpoint.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Confluence OAuth...

Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting Detection

Oracle Secure Global Desktop Administration Console 4.4 contains a reflected cross-site scripting vulnerability in helpwindow.jsp via all parameters, as demonstrated by the sgdadmin/faces/comsunwebui/help/helpwindow.jsp windowTitle parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle...

TOTOLINK/Realtek Routers - Information Disclosure Detection

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...