FLIX AX8 1.46.16 Remote Command Execution

-- coding: utf-8 -- Exploit Title: FLIR AX8 Unauthenticated OS Command Injection Date: 8/19/2022 Exploit Author: Samy Younsi Naqwada https://samy.link Vendor Homepage: https://www.flir.com/ Software Link: https://www.flir.com/products/ax8-automation/ PoC: https://www.youtube.com/watch?v=dh0rfAIWo...

CVE-2022-36266

creationtimestamp| type| source ---|---|--- 2022-08-08 18:23:41+00:00| seen| https://t.me/cibsecurity/47731 2024-03-11 07:14:50+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/10122...

CVE-2022-36266

CVE-2022-36266 affects Airspan AirSpot 5410 (versions 0.3.4.1-4 and earlier). The issue is a stored XSS vulnerability in the login.cgi endpoint, which does not verify authentication. A malicious request can carry a base32-encoded XSS payload that is stored and later reflected on the user settings...