CVE-2018-8032

Axis Apache eXtensible Interaction System ------------------------------------------- Welcome to Axis! You'll find documentation in the docs/ directory. Please read the release notes release-notes.html in this directory for details on the current release. Thanks from all of us on the Axis team fo...

cve-2025-11142-axis-mediaclip-rce

CVE-2025-11142 — AXIS mediaclip.cgi OS Command Injection n-day research writeup & PoC — post-patch technical analysis of a CVSS 7.1 OS command injection vulnerability in the AXIS VAPIX Media Clip API, independently rediscovered and verified through black-box testing against an Axis device. Axis's...

axis-RCE

CVE-2025-30026 + CVE-2025-30023: Unauth RCE This exploit chains CVE‑2025‑30026 Authentication bypass with CVE‑2025‑30023 Insecure deserialization to achieve unauthenticated RCE on Axis Camera Station software. It bypasses the login mechanism and delivers malicious serialized payloads that trigger...

Axis1.4-CVE-2019-0227

Axis1.4 CVE-2019-0227 Remote Command Execution Exploit Tool 📖 Vulnerability Description Apache Axis1.4 contains a remote command execution vulnerability CVE-2019-0227. When the enableRemoteAdmin property is set to true, an attacker can deploy a malicious service through the AdminService interface...

CVE-2025-0324-axis-vapix-privesc

CVE-2025-0324 — Root Cause Analysis A client-controlledHost header as a root-group backdoor in the AXIS OS VAPIX Device Configuration framework. %20%2F%208.8%20High%20\NVD-b3261e TL;DR Axis Communications disclosed CVE-2025-0324 on 2025-06-02 as a critical CVSS 9.4 privilege-escalation flaw in th...

cve-2019-0227

cve-2019-0227 Apache Axis 1.4 remote code execution vulnerability You need to set up a listener on the local machine with msf, and also modify lines 24-30 of the code. ＃You need to change these variables to match your configuration myip = “ 192.168.0.117 ” ＃Your machine's IP target = “...

CVE-2026-90436

A flaw was found in Apache Axis. An unauthenticated remote attacker can exploit an insecure deserialization issue by sending a specially crafted Simple Object Access Protocol SOAP fault message. Because the message is parsed and classes are instantiated before authentication handlers are evaluate...

CVE-2026-63286

CVE-2026-63286: Axis Camera Station ACS Decryptor Proof-of-concept decryptor for the credential-encryption scheme used by AXIS Camera Station. The software stores secrets in its Firebird database ACS.FDB encrypted with AES-256-CBC. The key is NOT a per-installation random secret: it is derived fr...

Apache Axis Class Selection Code Execution

The vulnerability in the Apache Axis web service platform is related to the use of externally controlled input for class selection. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

VulnCheck KEV: CVE-2026-90436

UNSUPPORTED WHEN ASSIGNED Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP carries a element, Axis loads the named class and, if a String element is also present, instantiates it through its String constructor before checki...

CVE-2026-124693

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user vie...

CVE-2026-124693 Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user vie...

CVE-2026-124693

The Kendo UI for jQuery component (versions 2026.3.1015 up to but not including 2026.4.1110 ) contains a Cross-Site Scripting (XSS) vulnerability in the PivotGrid and PivotConfigurator components. The root cause is the lack of appropriate encoding when axis field names are passed to a chip templa...

EUVD-2026-123602

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user vie...

CVE-2026-124693: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and…

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user vie...

PT-2026-145279

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user vie...

Exploit for CVE-2026-90436

CVE-2026-90436 — Apache Axis 1.x unauthenticated remote class...

CVE-2026-63287

It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station...

EUVD-2026-120810

It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station...

CVE-2026-63287

In AXIS Camera Station , an authenticated non-admin user can modify specific data objects without the required permissions. This vulnerability, rooted in Incorrect Authorization (CWE-863) and Improper Output Neutralization for Logs (CWE-117), allows an attacker to tamper with the creation of audi...