Sunhillo SureLine session mechanism vulnerability

Versions prior to Sunhillo SureLine 9.1.5 contain a vulnerability related to the session mechanism. This vulnerability stems from authentication bypass; unauthenticated remote attackers can forge session cookies containing only plaintext usernames, lacking random identifiers or integrity checks. ...

EUVD-2026-102472

Jooan JA-A12 IP cameras with firmware 00920171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen...

CVE-2026-111281

Jooan JA-A12 IP cameras with firmware 00920171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen...

CVE-2026-111281 Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials

Jooan JA-A12 IP cameras with firmware 00920171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen...

CVE-2026-111221

Rejected reason: This CVE ID has been rejected because it does not describe a security vulnerability...

CVE-2026-111218

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

CVE-2026-111220

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfacespppsedit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit...

EUVD-2026-102332

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfacespppsedit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit...

CVE-2026-111220

pfSense CE versions through 2.9.0 are vulnerable to a crontab injection vulnerability in the interfaces_ppps_edit.php component. The root cause is the failure to escape newline characters in the ptpid or reset hour/minute fields, which are processed by the configure_cron() function. An authentica...

CVE-2026-111220 Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfacespppsedit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit...

CVE-2026-111220 Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfacespppsedit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit...

CVE-2026-111219

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in servicespppoeedit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making...

CVE-2026-111219 Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in servicespppoeedit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making...

CVE-2026-111218

Netgate pfSense CE 2.7.0 through 2.9.0 is vulnerable to an OS command injection vulnerability within the Traffic Shaper Limiters . Authenticated users possessing Traffic Shaper Limiters privileges can execute commands as root by tampering with the limiter number field . The flaw occurs because th...

CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...

CVE-2026-111220: Improper Neutralization of CRLF Sequences

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfacespppsedit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit...

PT-2026-115272

Name of the Vulnerable Software and Affected Versions Jooan JA-A12 IP cameras version 009 20171107 Jooan JA-A12 IP cameras version 05.02.31.105 Description Unauthenticated attackers can achieve remote code execution and gain full device control by utilizing hard-coded credentials. The issue occur...

CVE-2026-111281: Use of Hard-coded Credentials

Jooan JA-A12 IP cameras with firmware 00920171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen...

PT-2026-115184

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services pppoe edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making...

PT-2026-115183

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...