CVE-2023-29117 Authentication Bypass in JuiceBox Web Manager interface

Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system...

CVE-2023-29121: Improper Access Control

Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system...

Cross site request forgery (csrf)

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges...