Advantech R-SeeNet 2.4.12 - OS Command Injection

Advantech R-SeeNet 2.4.12 is susceptible to remote OS command execution via the ping.php script functionality. An attacker, via a specially crafted HTTP request, can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering...

Advantech R-SeeNet - Cross-Site Scripting

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the deviceid parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. id: CVE-2021-21802 info: name: Advantech R-SeeNet - Cross-Site Scripting author:...

Advantech WISE-IoTSuite/SaaS - SQL Injection

Advantech WISE-IoTSuite/SaaS Composer suffers from an unauthenticated SQL Injection vulnerability due to the unsafe use of the filename parameter within the URL path in PostgreSQL queries. Remote attackers can exploit this flaw by injecting SQL code such as the use of pgsleep for time delays to...

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

Advantech R-SeeNet 2.4.12 contains a reflected cross-site scripting vulnerability in the sshform.php script functionality. id: CVE-2021-21800 info: name: Advantech R-SeeNet 2.4.12 - Cross-Site Scripting author: arafatansari severity: medium description: | Advantech R-SeeNet 2.4.12 contains a...

Advantech R-SeeNet - Cross-Site Scripting

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the graph parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. id: CVE-2021-21801 info: name: Advantech R-SeeNet - Cross-Site Scripting author: gy74...

Advantech R-SeeNet - Cross-Site Scripting

Advantech R-SeeNet is vulnerable to cross-site scripting via the devicegraphpage.php script via the is2sim parameter. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. id: CVE-2021-21803 info: name: Advantech R-SeeNet - Cross-Site...

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

Advantech R-SeeNet 2.4.12 contains a reflected cross-site scripting vulnerability in the telnetform.php script functionality. id: CVE-2021-21799 info: name: Advantech R-SeeNet 2.4.12 - Cross-Site Scripting author: arafatansari severity: medium description: | Advantech R-SeeNet 2.4.12 contains a...

CVE-2025-48461

CVE-2025-48461 Predictable session cookies that can be bruteforced to gain unauthorized access to Advantech WISE portal Summary During examination of Advantech WISE-4060 web portal, I have discovered that the session cookies used to authenticate to the web portal follows the pattern 60D01EXXXXX...

CVE-2025-48466

CVE-2025-48466 Modbus Packet Injection on Advantech WISE 4060LAN / IoT Gateway for door control. see script: main.py Summary I was able to figure out that it is just very easy to somehow manipulate the Modbus server running on an IoT Gateway for door control on a network. Any remote attacker...

CVE-2026-36226

CVE-2026-36226: Advantech WebAccess/SCADA Create New Project User XSS PoC This repository contains a benign proof of concept for CVE-2026-36226, a cross-site scripting issue in Advantech WebAccess/SCADA 8.0-2015.08.16. This repository is for authorized security research and local reproduction onl...

CVE-2025-52694-POC

CVE-2025-52694: Advantech SaaS Composer SQL Injection This repository contains Proof-of-Concept PoC tools for CVE-2025-52694 , a critical unauthenticated SQL Injection vulnerability affecting Advantech IoTSuite and IoT Edge Products. Vulnerability Overview Attribute| Details ---|--- CVE ID|...

exploit-CVE-2026-2670

exploit-CVE-2026-2670 CVE-2026-2670 – Advantech WISE-6610 Command Injection PoC Proof-of-concept exploit demonstrating a command injection vulnerability in the Advantech WISE-6610 industrial cellular router. The vulnerability exists in the /cgi-bin/luci/admin/openvpnapply endpoint and allows an...

Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx Leadin — Detect

Fingerprint / reachability check for Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx Leading to Code Execution in the IIS Worker Process !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx...

Advantech WebAccess CrystalRpt unauth ASPX upload RCE

Unauthenticated CrystalRpt.aspx path traversal upload writes ASPX under IIS app root; invoke via ?c= for cmd.exe execution reverse shell via set payload. """Advantech WebAccess CrystalRpt.aspx unauthenticated upload → ASPX RCE.""" from future import annotations import posixpath import re import...

Advantech Adam-3600 security vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have security vulnerabilities. These vulnerabilities stem from a null pointer dereferencing in the ondisconnected callback function of the license manager service. This could allow unauthenticated attackers to cause the service to crash...

Advantech Adam-3600 authorization issue vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have an authorization issue vulnerability. This vulnerability stems from problems with the password reset mechanism, which may allow attackers to bypass the authentication mechanism...

Advantech Adam-3600 code injection vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have a code injection vulnerability. This vulnerability stems from code injection, and it may allow remotely authenticated attackers to execute arbitrary code with service privileges...

Advantech Adam-3600 buffer error vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have a buffer overflow vulnerability. This vulnerability stems from a stack-based buffer overflow, which may allow authenticated attackers to execute arbitrary code...

Advantech Adam-3600 digital error vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have a numerical error vulnerability. This vulnerability stems from an integer overflow in the license manager service, which could allow unauthenticated attackers to cause the service to crash...

Advantech Adam-3600 buffer error vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have a buffer overflow vulnerability. This vulnerability stems from the FileProcess::CheckDir function, which has a stack-based buffer overflow. A remotely authenticated attacker can execute arbitrary code by using a path that exceeds 1024 bytes...