CVE-2026-12070 TeamDavid: Arbitrary File Deletion via form field 'scjob'

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid before Rollout 52...

CVE-2026-12070

Affected software : Tobit Laboratories AG TeamDavid’s Webbox. Vulnerability : Arbitrary file deletion via an @@COMMENTFILE command in the form field scjob, enabling deletion of any file on the system. Impact : According to the CVE entry, this affects TeamDavid through Rollout 524, with high impac...

EUVD-2026-54424

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid through Rollout 5...

CVE-2026-12070

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid through Rollout 5...

CVE-2026-12070 TeamDavid: Arbitrary File Deletion via form field 'scjob'

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid before Rollout 52...

PT-2026-68911

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains an open redirect issue. An attacker can craft a URL that redirects the user's browser to an arbitrary third-party site via the replyUrl...

PT-2026-68914

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains a flaw where a hard-coded cryptographic key is used. Passwords for users created locally in David are stored in multiple files using only...

PT-2026-68901

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The link storing functionality at the endpoint '//ServerClient celink.htm' accepts a pathname parameter that can be set to network locations using UNC paths. The server processes these paths...

PT-2026-68903

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The move archive functionality !ArcEntryMove in the Webbox component processes the pathname parameter without proper validation. This allows an attacker to provide arbitrary paths, including...

PT-2026-68892

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The send email, fax, and SMS functionality allows for arbitrary file deletion. An attacker can delete any file on the system by specifying an @@COMMENTFILE command within the scjob form field...

PT-2026-68893

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox component constructs redirect URLs using user-supplied input appended to the redirect target in a 302 HTTP response. An attacker can use URL-encoded characters, such as %2e...

PT-2026-68905

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application handles password changes via a function triggered by including the string "editini" in the file path to write a new password to the "Archive.ini" file. The application...

PT-2026-68900

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The search functionality of the Webbox component allows unauthenticated users to provide a pathnameroot parameter containing Universal Naming Convention UNC paths. Because the server does not...

PT-2026-68899

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description A memory leak in the Webbox component allows an unauthorized actor to read sensitive information, including user passwords. This occurs when the application responds with memory contents upon...

PT-2026-68910

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application is susceptible to HTTP header injection via the cType URL parameter. The application fails to properly restrict control characters, such as colons or URL-encoded newlin...

PT-2026-68897

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox fails to enforce authentication or authorization checks when serving log files. This allows attackers to access sensitive error information and intern...

PT-2026-68909

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application exposes a functionality that allows the server to be shut down when the '/internalRestart' endpoint is accessed. This endpoint is accessible to unauthenticated users ov...

PT-2026-68902

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox sending functionality for email, fax, and SMS accepts a @@INCLUDE command that can be configured with network locations using UNC paths. The server processes these paths without...

PT-2026-68895

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains a flaw in its link storing functionality at the endpoint '//ServerClient celink.htm'. The application fails to properly sanitize the request...

PT-2026-68896

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains a local file inclusion issue within the functionality used to send emails, faxes, and SMS. An authenticated user can attach files to a messag...