CVE-2023-43149

CVE-2023-43149 작성자 : Aitor Herrero Fuentes 공급업체: SPA-Cart 공급업체 홈페이지: https://spa-cart.com/ 소프트웨어 링크: https://demo.spa-cart.com/admin 버전: 1.9.0.3 테스트 환경: Windows 10 Pro CSRF 루트 계정 추가 애플리케이션 demo.spa-cart.com의 교차 사이트 요청 위조 취약점으로 인해 원격 공격자가 임의의 코드를 실행하고, "role status"를 가진 악성 사용자를 한 번의 클릭으로 추가할 수 있습니...

CVE-2016-5195

dirtycow Cet exploit utilise l'exploit pokemon de la vulnérabilité dirtycow comme base et génère automatiquement une nouvelle ligne passwd. L'utilisateur se verra demander le nouveau mot de passe lors de l'exécution du binaire. Le fichier /etc/passwd original est alors sauvegardé dans...

Poc-CVE-2024-57040

Poc-CVE-2024-57040 CVE-2024-57040 est une vulnérabilité de sécurité trouvée dans certains modèles de routeur TP-Link TL-WR845N. Spécifiquement, elle implique un mot de passe "codé en dur" pour le compte root du routeur. Cela signifie qu'un mot de passe par défaut et immuable est intégré dans le...

CVE-2026-1459-POC

CVE-2026-1459-POC POC для CVE-2026-1459, полезная нагрузка которого изменяет root-пароль SSH. Требуются действительные учётные данные администратора, временно изменяет root-пароль, перезагрузка сбросит root-пароль. Работает на VMG3625-T50B и аналогичных устройствах, гарантированно работает на...

CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form performs no object-level authorization check on userid = 1. A Secondary Administrator usertype = 1, userid != 1 can rewrite the Primary Administrator's usertype to 2...

CVE-2026-88956

The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...

CVE-2026-88956 Botslab G980H Dashcams Missing Authentication for Critical Function

The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...

CVE-2026-88956

The Botslab G980H dash camera firmware is vulnerable to an authentication vulnerability involving the root account accessible via the device's UART interface . Because the account does not require a password, an unauthenticated attacker with physical access to the device can connect to the UART i...

EUVD-2026-86454

The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...

CVE-2026-88956: Missing Authentication for Critical Function

The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's...

EUVD-2026-84683

LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where root and guest account passwords are stored as reversible hashes in /etc/shadow, recoverable using dictionary-based cracking tools. Attackers can use the recovered credentials to authenticate via Telnet or SSH and obtain...

CVE-2025-15679

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...

CVE-2025-15679 BMC root account active without password on BullSequana XH3406 and XH3515

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...

CVE-2025-15679 BMC root account active without password on BullSequana XH3406 and XH3515

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...

EUVD-2025-210890

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...

CVE-2025-15679

CVE-2025-15679 affects the BMC (Baseboard Management Controller) root account , which can become active without a password under certain circumstances such as a reset to factory default operation. This grants unauthenticated local access with HIGH impact on confidentiality, integrity, and availab...

CVE-2025-15679: Empty Password in Configuration File

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...

PT-2026-89807

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password...

PT-2026-85524

Holloway Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's...

EUVD-2026-68921

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access or allowed to change their own shell access to...