CVE-2026-75168

The MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) is vulnerable to an issue in the ugw-editfile method of the /cgi-bin/wwwugw.cgi component. This flaw allows a remote authenticated user with a low-privileged Standard role to write arbitrary content to files located within the /uxx/config/ an...

CVE-2026-75160: Improper Privilege Management

An issue in X-Serie Gateway Firmware V60005 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi...

EUVD-2026-71455

An issue in X-Serie Gateway Firmware V60005 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi...

CVE-2026-75163: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...

CVE-2026-85547: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-75161

The MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) is vulnerable to an arbitrary code execution flaw. The issue exists within the ugw-restart method of the /cgi-bin/wwwugw.cgi component. A remote authenticated user with a low-privileged Standard role can exploit this flaw to inject arbitrary ...

CVE-2026-75167

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...

CVE-2026-79419

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to...

CVE-2026-75165

An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods ugw-ping, ugw-traceroute that are not exposed in the web UI, allowing attackers to obtain sensitive...

CVE-2026-75165

The MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) is vulnerable due to an issue in /cgi-bin/wwwugw.cgi . This flaw allows a remote authenticated user with low-privileged Standard role permissions to invoke hidden network diagnostic methods, specifically ugw-ping and ugw-traceroute , which ar...

PT-2026-85409

Name of the Vulnerable Software and Affected Versions XING CPTrans-ME-X affected versions not specified Description XING CPTrans-ME-X contains an OS Command Injection flaw, which allows an unauthenticated user to inject and execute arbitrary operating system commands. Recommendations At the momen...

PT-2026-85680

CVE-2026-75165: Authenticated RCE risk via hidden diagnostics in MBS-Solutions X-Serie Gateway V6 00 05. Low-privileged users can trigger ugw-ping/traceroute to leak sensitive data. CVSS: N/A, unpatched. Restrict access & monitor https://t.co/IrWuE7APR9 cybersecurit valtersit CVE CVEAlert infosec...

CVE-2026-79419

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to...

CVE-2026-75166

Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V60005 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2026-75161

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root...

CVE-2026-79419: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to...

CVE-2026-79418: Improper Neutralization of Input During Web Page Generation

EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...

CVE-2026-75169: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2026-75168: Improper Access Control

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...