Cisco Finesse - Server-Side Request Forgery (SSRF)

Cisco Finesse contains an SSRF caused by insufficient validation of user-supplied input in HTTP requests, letting unauthenticated remote attackers access limited sensitive information, exploit requires sending crafted HTTP requests. id: CVE-2024-20404 info: name: Cisco Finesse - Server-Side Reque...

Cisco Small Business RV Series - OS Command Injection

Cisco Small Business RV Series routers RV16X/RV26X versions 1.0.01.02 and before and RV34X versions 1.0.03.20 and before contain multiple OS command injection vulnerabilities in the web-based management interface. A remote attacker can execute arbitrary OS commands via the sessionid cookie or...

Lantronix PremierWave 2050 8.9.0.0R4 - Remote Command Injection

Lantronix PremierWave 2050 8.9.0.0R4 contains an OS command injection vulnerability. A specially-crafted HTTP request can lead to command in the Web Manager Wireless Network Scanner. An attacker can make an authenticated HTTP request to trigger this vulnerability. id: CVE-2021-21881 info: name:...

Cisco HyperFlex HX Data Platform - Arbitrary File Upload

Cisco HyperFlex HX Data Platform contains an arbitrary file upload vulnerability in the web-based management interface. An attacker can send a specific HTTP request to an affected device, thus enabling upload of files to the affected device with the permissions of the tomcat8 user. id:...

Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion

Cisco Linksys WVC54GCA 1.00R22/1.00R24 is susceptible to local file inclusion in adm/file.cgi because it allows remote attackers to read arbitrary files via a %2e. encoded dot dot or an absolute pathname in the nextfile parameter. id: CVE-2009-1558 info: name: Cisco Linksys WVC54GCA 1.00R22/1.00R...

Cisco IOS XE WLC - Arbitrary File Upload

A vulnerability in the Out-of-Band Access Point AP Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.This vulnerability is due to the presence of a hard-coded JSON Web...

Cisco Unified Communications Manager 7/8/9 - Directory Traversal

A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815 id: CVE-2013-5528 info: name:...

CVE-2026-20131

CVE-2026-20131 — Cisco Secure FMC 원격 코드 실행 Java 역직렬화 심각도: 치명적 CVSS 3.1: 10.0 CWE: CWE-502 — 신뢰할 수 없는 데이터의 역직렬화 영향 대상: Cisco Secure Firewall Management Center FMC Software 권고: cisco-sa-fmc-rce-NKhnULJh 버그 ID: CSCwt14636 개요 Cisco Secure Firewall Management Center FMC Software의 웹 기반 관리 인터페이스에서 발견된...

Ashwesker-CVE-2026-20045

🚨 CVE-2026-20045 — 제로데이 분석 🚨 🧨 개요 여러 Cisco Unified Communications 제품에 영향을 미치는 치명적인 원격 코드 실행RCE 취약점입니다. 패치가 배포되기 전에 실제 환경에서 적극적으로 악용되었습니다. 🔥 위험한 이유 🚫 인증 불필요 🖥️ 원격 코드 실행 👑 루트 수준 액세스 가능 🌍 실제 악용 사례 확인됨 이는 공격자가 영향을 받는 시스템을 원격으로 완전히 장악할 수 있음을 의미합니다. 🚨 CVE-2026-20045.py 사용 예시 PoC 스크립트 실행을 위한 사용 예시 가 포함된...

sdwan-scanner-CVE-2026-20127

Cisco SD-WAN 노출 스캐너 CVE-2026-20127 인터넷에 노출된 Cisco SD-WANvManage / Viptela 인스턴스를 식별하도록 설계된 특수 수동 핑거프린팅 도구입니다. 이 도구는 보안 연구원과 시스템 관리자가 잠재적으로 노출된 관리 인터페이스와 NETCONF 포트를 감지하여 외부 공격 표면을 관리하는 데 도움을 줍니다. 🚀 기능 다중 포트 분석 : 22SSH, 443HTTPS, 830NETCONF을 포함한 일반적인 SD-WAN 포트를 스캔합니다. HTTP/HTTPS 핑거프린팅 : 페이지 제목과...

The vulnerability in the application software interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the application programming interface of the Cisco Identity Services Engine ISE management platform is related to errors that occur when privileged application programming interfaces are used. Exploiting this vulnerability can allow a malicious actor to bypass existing securi...

day08-CISCO-fmc-sim

Day08 — Cisco FMC-style Management RCE Simulation This is a minimal, educational simulation that demonstrates the impact class of a management-plane parsing RCE inspired by CVE-2025-20265. It intentionally executes commands from crafted input for local learning only. Quickstart root@kitploit: chm...

CVE-2026-76450

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76451

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76449

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76460

A vulnerability in an API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request ...

CVE-2026-76448

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76447

A vulnerability in the Online Certificate Status Protocol OCSP responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerability is due to missing authentication on a...

CVE-2026-76446

A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device. This vulnerability is due to improper restriction of XML external entity references. An attacker could exploit th...

CVE-2026-76444

A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to missing authentication on the Policy Runtime Repository Table PRRT service. A...