PT-2025-34213 · Exagrid · Exagrid Ex10

Name of the Vulnerable Software and Affected Versions: Exagid EX10 version 7.0.1p02 Description: An XML external entities XXE injection vulnerability exists in the /init API endpoint. An authenticated, unprivileged attacker can achieve information disclosure and privilege escalation by submitting...

Exagrid EX10 安全漏洞

Exagrid EX10 is a backup storage server from Exagrid Corporation, USA. A security vulnerability exists in Exagrid EX10 version 7.0.1p02, which originates from the presence of XML external entity injection in the /init API endpoint, which could lead to information disclosure and elevation of...

CVE-2025-29557

ExaGrid EX10 (versions 6.3–7.0.1.P08) is vulnerable to Incorrect Access Control in the MailConfiguration API endpoint. The issue allows users with operator-level privileges to issue an HTTP request that retrieves SMTP credentials, including plaintext passwords. The root cause is improper access c...