CVE-2026-84860

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is s...

EUVD-2026-80827

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is s...

CVE-2026-84860

ScadaLTS 2.8.1-release-candidate build 0 suffers from an Authorization Bypass in its DWR (Direct Web Remoting) component. Spring Security restricts DWR endpoints by URL path pattern , but DWR actually dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName . Addi...

CVE-2026-84860 Scada-LTS DWR Authorization Bypass - Systemic

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is s...

CVE-2026-84860: Authorization Bypass Through User-Controlled Key

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is s...

PT-2026-93806

Name of the Vulnerable Software and Affected Versions ScadaLTS version 2.8.1-release-candidate build 0 Description An authorization bypass exists because Spring Security restricts DWR endpoints using URL path patterns, while DWR dispatches method calls based on the c0-scriptName and c0-methodName...

CVE-2021-40371

Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\ in a scriptName JSON value to ServiceManagerTenant/GetVisibilityMap...

PT-2021-22881

Name of the Vulnerable Software and Affected Versions Gridpro Request Management for Windows Azure Pack versions prior to 2.0.7912 Description The issue allows Directory Traversal for remote code execution. This can be demonstrated by using .. in a scriptName JSON value to the...

CVE-2021-40371: Improper Limitation of a Pathname to a Restricted Directory

Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\ in a scriptName JSON value to ServiceManagerTenant/GetVisibilityMap...

Sonicwall Secure Remote Access extensionsettings Command Execution

The vulnerability of the “extensionsettings” /cgi-bin/extensionsettings component of the CGI application for the web interface of the Dell Inc. Sonicwall Secure Remote Access SRA system management application is related to the lack of measures for cleaning input data. Exploiting this vulnerabilit...

Kaspersky Anti-Virus for Linux File Server scriptName Parameter File Disclosure

The vulnerability of the scriptName parameter in the licenseKeyInfo method of the Kaspersky Anti-Virus for Linux File Server security tool exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability can allow a malicious actor, operating remotely, to...

CVE-2017-9813

In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312, the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting XSS...

CVE-2017-9813: Improper Neutralization of Input During Web Page Generation

In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312, the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting XSS...

PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution Exploit

Exploit for php platform in category web applications !/usr/bin/python Exploit Title: RCE for PHPMailer 5.2.20 with Exim MTA Date: 16/06/2017 Exploit Author: @phacktul Software Link: https://github.com/PHPMailer/PHPMailer Version: 5.2.20 Tested on: Debian x86/x64 CVE :...

PT-2017-2895

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue concerns a cross-site scripting XSS vulnerability related to the scriptName parameter of the licenseKeyInfo action method. This vulnerability can be...

CVE-2016-9683

The SonicWall Secure Remote Access server version 8.1.0.2-14sv is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'extensionsettings' CGI /cgi-bin/extensionsettings component responsible for handling some of the server's...

PT-2017-3170

Name of the Vulnerable Software and Affected Versions SonicWall Secure Remote Access server version 8.1.0.2-14sv Description The vulnerability occurs in the 'extensionsettings' CGI component, specifically in the /cgi-bin/extensionsettings API endpoint, which handles internal server configurations...

CVE-2016-9683: Improper Neutralization of Special Elements used in a Command

The SonicWall Secure Remote Access server version 8.1.0.2-14sv is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'extensionsettings' CGI /cgi-bin/extensionsettings component responsible for handling some of the server's...

Oracle ATS DownloadServlet scriptName Directory Traversal (CVE-2016-0478)

A directory traversal vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests to the "/olt/download" URI with parameter scriptName. A remote unauthenticated attacker can exploit this vulnerability by...

Oracle Application Testing Suite DownloadServlet scriptName Parameter Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to exfiltrate arbitrary files on vulnerable installations of Oracle Application Testing Suite. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DownloadServlet. By providing a scriptName parameter containi...