117 matches found
cve-2025-11142-axis-mediaclip-rce
CVE-2025-11142 — AXIS mediaclip.cgi 操作系统命令注入 n-day 研究文章与 PoC — 针对 AXIS VAPIX Media Clip API 中 CVSS 7.1 操作系统命令注入漏洞的补丁后技术分析，通过黑盒测试针对 Axis 设备独立重新发现并验证。 Axis 官方公告未公布技术利用细节或公开 PoC（截至公告发布时，“Axis 不会提供有关该漏洞的更详细信息”，“目前没有公开已知的漏洞利用”）。本仓库记录了一项独立复现、基于证据的确认，仅在供应商修复（AXIS OS 12.7.36）普遍可用后发布。参见披露时间线。 摘要 | ---|---...
Linux Distros Unpatched Vulnerability : CVE-2026-4757
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be...
CVE-2026-4757
A flaw was found in Axis. An attacker with an administrator-privileged service account could exploit improper input validation in a VAPIX API parameter. This could allow for arbitrary code execution and potentially lead to privilege escalation, granting the attacker higher system privileges...
CVE-2026-4757
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account...
CVE-2026-4757
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account...
CVE-2026-4757
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account...
CVE-2026-4757
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account...
EUVD-2026-55968
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account...
CVE-2026-4757: Incorrect Permission Assignment for Critical Resource
A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account...
PT-2026-70068
Name of the Vulnerable Software and Affected Versions Axis Communications VAPIX API affected versions not specified Description Improper input validation in a VAPIX API parameter allows for remote code execution and potential privilege escalation. This issue requires authentication with a service...
Axis Communications AXIS OS Path Traversal (CVE-2024-0067)
A researcher in the AXIS OS Bug Bounty Program has found that the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allowing to list folder/file names on the local file system of the Axis device. Axis has released patched AXIS OS versions for this flaw. This plugin only works with...
Axis Communications AXIS OS Improper Validation of Specified Type of Input (CVE-2024-47262)
Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the web interface of the Axis device. Axis has released patched AXIS OS versions for this flaw. Endpoints not...
Axis Communications AXIS OS Improper Validation of Syntactic Correctness of Input (CVE-2024-8160)
A researcher in the AXIS OS Bug Bounty Program has found that the VAPIX API ftptest.cgi did not have a sufficient input validation allowing for a possible command injection to transfer files to/from the Axis device. This flaw can only be exploited after authenticating with an...
CVE-2025-11142
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account...
CVE-2025-11142
The CVE-2025-11142 vulnerability affects the VAPIX API mediaclip.cgi and arises from insufficient input validation, enabling potential remote code execution. Exploitation requires authentication with an operator- or administrator-privileged service account, and the impact is rated high (CVSSv3.1:...
CVE-2025-11142: Improper Neutralization of Special Elements used in an OS Command
The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator- privileged service account...
CVE-2025-9524
The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account...
CVE-2025-9524: Improper Validation of Specified Type of Input
The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. This vulnerability can only be exploited after authenticating with a viewer- operator- or administrator-privileged service account...