CVE-2026-70403

XING CPTrans-ME-X contains a Use of Hard-coded Password CWE-259. Anyone with the knowledge of the credential may log in to the affected device...

CVE-2026-69657

XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...

CVE-2026-69657

XING CPTrans-ME-X contains a Use of Default Password vulnerability (CWE-1393), meaning anyone who knows the default credential can log in to the affected device. The vulnerability is rated CRITICAL with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 base score...

EUVD-2026-70918

XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...

CVE-2026-66840

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497. Sensitive system information may be leaked...

EUVD-2026-70917

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497. Sensitive system information may be leaked...

CVE-2026-66840

XING CPTrans-ME-X , a rack accessory product, is affected by an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) , which may allow sensitive system information to be leaked. The vulnerability is exploitable over the network with low complexity , requires no pri...

EUVD-2026-70916

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

CVE-2026-62928

XING CPTrans-ME-X , a rack accessory product, contains an OS Command Injection vulnerability (CWE-78) that allows unauthenticated attackers to inject arbitrary OS commands. The flaw carries a CVSS 9.8 CRITICAL score (v3.0) with high impact on confidentiality, integrity, and availability, indicati...

CVE-2026-62928

XING CPTrans-ME-X contains an OS Command Injection CWE-78. Unauthenticated OS command may be injected...

CVE-2026-75167

CVE-2026-75167 is a broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 . A remote authenticated user holding only the low-privileged Standard role can change the password of arbitrary accounts , enabling privile...

EUVD-2026-71454

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root...

EUVD-2026-71452

An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentia...

PT-2026-85410

Name of the Vulnerable Software and Affected Versions XING CPTrans-ME-X affected versions not specified Description XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere, which may lead to the leakage of sensitive system information...

CVE-2026-75162

CVE-2026-75162 is an information disclosure vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 , specifically in the opcua-configuration method of /cgi-bin/wwwugw.cgi. Any remote authenticated user—including those with the low-privileged Standard role—can retrieve configured OPC-UA ...

CVE-2026-75165

CVE-2026-75165 affects the MBS-Solutions X-Serie Gateway (firmware V6_00_05 ). The vulnerability resides in /cgi-bin/wwwugw.cgi , where hidden network diagnostic methods (ugw-ping, ugw-traceroute) are invocable by a remote, authenticated user holding the low-privileged Standard role, despite not ...

PT-2026-85409

Name of the Vulnerable Software and Affected Versions XING CPTrans-ME-X affected versions not specified Description XING CPTrans-ME-X contains an OS Command Injection flaw, which allows an unauthenticated user to inject and execute arbitrary operating system commands. Recommendations At the momen...

CVE-2026-75168

MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) contains a vulnerability in the ugw-editfile method of /cgi-bin/wwwugw.cgi that allows a remote, authenticated user holding the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/. The CVSS 3.1 ba...

CVE-2026-75169

CVE-2026-75169 is an arbitrary file upload vulnerability in the /cgi-bin/ugwupload.cgi endpoint of MBS-Solutions X-Serie Gateway firmware V6_00_05 . A remote authenticated user with Admin role can upload files with arbitrary content to hardcoded paths , enabling full compromise (CVSS 8.8 HIGH , C...

CVE-2026-79418

EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...