80 matches found
CVE-2020-14068
An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executarlogin.php...
CVE-2020-14072
An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...
CVE-2020-14070
An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executarlogin.php result in admin access...
CVE-2020-14071
An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...
CVE-2020-14069
An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...
CVE-2020-14071
An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...
Code injection
An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...
Sql injection
An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executarlogin.php...
Sql injection
An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...
Command injection
An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...
CVE-2020-14072
An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...
CVE-2020-14072
CVE-2020-14072 affects MK-AUTH 19.01. The issue enables command execution as root through shell metacharacters in /auth admin scripts. Public sources in the connected set confirm the vulnerability but do not provide explicit exploit details, affected build variants beyond 19.01, or concrete remed...
CVE-2020-14071
The CVE-2020-14071 entry relates to MK-AUTH 19.01, where cross-site scripting (XSS) in both admin and client scripts allows an attacker to execute arbitrary JavaScript. The available connected documents confirm the affected product/version and the nature of the vulnerability but do not provide ex...
CVE-2020-14071
An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...
CVE-2020-14070
MK-AUTH 19.01 suffers an authentication bypass in the web login, caused by guessable credentials to admin/executar_login.php, enabling admin access. CVE-2020-14070 affects MK-AUTH 19.01; impact is rated CRITICAL (CVSS v3.1: 9.8) with potential full compromise of confidentiality, integrity, and av...
CVE-2020-14070
An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executarlogin.php result in admin access...
CVE-2020-14069
CVE-2020-14069 affects MK-AUTH 19.01, with SQL injection in the mkt/ PHP scripts (arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, wifi.php). Root cause is improper handling of user-supplied input leading to SQL injection. The public documents confirm the v...
CVE-2020-14069
An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...
CVE-2020-14068
CVE-2020-14068 affects MK-AUTH 19.01, where the web login feature is vulnerable to SQL injection in central/executar_login.php, enabling unauthenticated attackers to bypass authentication and obtain client privileges. Multiple sources (NVD, Red Hat, CNVD, CVE lists) corroborate the issue. NVD met...
CVE-2020-14068
An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executarlogin.php...