CVE-2020-14071

An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...

CVE-2020-14072

An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...

CVE-2020-14071

An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...

CVE-2020-14070

An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executarlogin.php result in admin access...

CVE-2020-14069

An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...

Code injection

An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...

Sql injection

An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executarlogin.php...

Sql injection

An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...

Command injection

An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...

CVE-2020-14072

An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...

CVE-2020-14072

CVE-2020-14072 affects MK-AUTH 19.01. The issue enables command execution as root through shell metacharacters in /auth admin scripts. Public sources in the connected set confirm the vulnerability but do not provide explicit exploit details, affected build variants beyond 19.01, or concrete remed...

CVE-2020-14071

The CVE-2020-14071 entry relates to MK-AUTH 19.01, where cross-site scripting (XSS) in both admin and client scripts allows an attacker to execute arbitrary JavaScript. The available connected documents confirm the affected product/version and the nature of the vulnerability but do not provide ex...

CVE-2020-14071

An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code...

CVE-2020-14070

An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executarlogin.php result in admin access...

CVE-2020-14070

MK-AUTH 19.01 suffers an authentication bypass in the web login, caused by guessable credentials to admin/executar_login.php, enabling admin access. CVE-2020-14070 affects MK-AUTH 19.01; impact is rated CRITICAL (CVSS v3.1: 9.8) with potential full compromise of confidentiality, integrity, and av...

CVE-2020-14069

An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php...

CVE-2020-14069

CVE-2020-14069 affects MK-AUTH 19.01, with SQL injection in the mkt/ PHP scripts (arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, wifi.php). Root cause is improper handling of user-supplied input leading to SQL injection. The public documents confirm the v...

CVE-2020-14068

An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executarlogin.php...

CVE-2020-14068

CVE-2020-14068 affects MK-AUTH 19.01, where the web login feature is vulnerable to SQL injection in central/executar_login.php, enabling unauthenticated attackers to bypass authentication and obtain client privileges. Multiple sources (NVD, Red Hat, CNVD, CVE lists) corroborate the issue. NVD met...

century21.mk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1187008 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...