CVE-2026-54202: Absolute Path Traversal

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folde...

CVE-2026-12071: URL Redirection to Untrusted Site

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...

PT-2026-68912

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application contains a reflected cross-site scripting XSS flaw. An attacker can execute a malicious payload in a victim's browser by sending a specially crafted link. This is...

PT-2026-68911

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains an open redirect issue. An attacker can craft a URL that redirects the user's browser to an arbitrary third-party site via the replyUrl...

PT-2026-68900

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The search functionality of the Webbox component allows unauthenticated users to provide a pathnameroot parameter containing Universal Naming Convention UNC paths. Because the server does not...

PT-2026-68910

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application is susceptible to HTTP header injection via the cType URL parameter. The application fails to properly restrict control characters, such as colons or URL-encoded newlin...

PT-2026-68897

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox fails to enforce authentication or authorization checks when serving log files. This allows attackers to access sensitive error information and intern...

PT-2026-68902

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox sending functionality for email, fax, and SMS accepts a @@INCLUDE command that can be configured with network locations using UNC paths. The server processes these paths without...

PT-2026-68895

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains a flaw in its link storing functionality at the endpoint '//ServerClient celink.htm'. The application fails to properly sanitize the request...

PT-2026-68896

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains a local file inclusion issue within the functionality used to send emails, faxes, and SMS. An authenticated user can attach files to a messag...

PT-2026-68904

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application allows an unauthenticated attacker to create or modify files on the server using attacker-controlled content. This occurs because user input is written directly to file...

PT-2026-68908

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application contains a buffer overflow condition in an API endpoint. An unauthenticated attacker can trigger a server crash and denial of service by submitting a specially crafted...

PT-2026-68899

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description A memory leak in the Webbox component allows an unauthorized actor to read sensitive information, including user passwords. This occurs when the application responds with memory contents upon...

PT-2026-68909

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application exposes a functionality that allows the server to be shut down when the '/internalRestart' endpoint is accessed. This endpoint is accessible to unauthenticated users ov...

CVE-2026-54199: Improper Input Validation

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...

PT-2026-68906

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application contains file upload functionalities susceptible to a buffer overflow. An unauthenticated attacker can cause a server crash and a subsequent denial of service by...

PT-2026-68898

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains a path traversal flaw in the archive creation functionality. This occurs because the archive path is user-controlled and lacks sufficient...

PT-2026-68913

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application is susceptible to stored cross-site scripting XSS, a flaw where malicious scripts are permanently stored on the target server. An attacker can exploit this by sending a...

PT-2026-68905

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application handles password changes via a function triggered by including the string "editini" in the file path to write a new password to the "Archive.ini" file. The application...

PT-2026-68914

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description Tobit Laboratories AG TeamDavid's Webbox contains a flaw where a hard-coded cryptographic key is used. Passwords for users created locally in David are stored in multiple files using only...