OpenDreambox 2.0.0 - Remote Code Execution

OpenDreambox 2.0.0 is susceptible to remote code execution via the webadmin plugin. Remote attackers can execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI in enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py. id: CVE-2017-14135 info: nam...

CVE-2025-68723

CVE-2025-68723: Axigen WebAdmin Stored XSS Vulnerability Summary Multiple input fields within the Axigen WebAdmin interface lack proper sanitization, allowing for the execution of malicious JavaScript. These vulnerabilities enable a low-privileged administrator or an attacker leveraging Broken...

CVE-2025-68721

CVE-2025-68721: Axigen WebAdmin Broken Access Control Vulnerability Summary A flaw in the permission logic allows an administrator account with zero permissions to access the "Security & Filtering" page, specifically the SSL Certificates endpoint. While other restricted sections are correctly...

CVE-2025-68722

CVE-2025-68722: Axigen WebAdmin CSRF Vulnerability Summary Critical state-changing actions in the Axigen WebAdmin interface are accessible via GET requests. While the h token protects against direct CSRF, the application processes queued requests via the s breadcrumb parameter immediately after a...

CVE-2026-119762

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request t...

EUVD-2026-114239

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request t...

CVE-2026-119762

Axigen Mail Server versions before 10.5.69 , 10.6.x before 10.6.40 , and 10.7.x before 10.7.2 are vulnerable to an unauthenticated denial of service (DoS) . The root cause is unbounded nesting depth during the parsing of SOAP/XML and JSON request bodies before authentication. An attacker can send...

CVE-2026-119762 Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request t...

CVE-2026-119762 Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request t...

CVE-2015-20130

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

CVE-2015-20130 Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

CVE-2015-20130

Netsweeper versions before 4.0.11 and 4.1.0 before 4.1.5 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the webadmin/reporter/view_server_log.php component. The root cause is the lack of proper output encoding when handling the log request parameter. Remote attackers ca...

EUVD-2015-9439

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

VulnCheck KEV: CVE-2015-20130

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

PT-2026-133615

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view server log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the...

CVE-2026-119762: Axigen Axigen Mail Server: Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial…

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request t...

CVE-2015-20130: Netsweeper: Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in…

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

PT-2026-133711

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request t...

Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained — Detect

Fingerprint / reachability check for Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the WebAdmin Blazor Application CWE-306, CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Titan MFT Server 26.0.0 - Unauthenticate...

Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the Web

Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the WebAdmin Blazor Application CWE-306, CWE-78 """Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the WebAdmin Blazor...