CVE-2026-75165

CVE-2026-75165 affects the MBS-Solutions X-Serie Gateway (firmware V6_00_05 ). The vulnerability resides in /cgi-bin/wwwugw.cgi , where hidden network diagnostic methods (ugw-ping, ugw-traceroute) are invocable by a remote, authenticated user holding the low-privileged Standard role, despite not ...

CVE-2026-79418

EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...

EUVD-2026-71457

EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...

PT-2026-85409

Name of the Vulnerable Software and Affected Versions XING CPTrans-ME-X affected versions not specified Description XING CPTrans-ME-X contains an OS Command Injection flaw, which allows an unauthenticated user to inject and execute arbitrary operating system commands. Recommendations At the momen...

CVE-2026-75168

MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) contains a vulnerability in the ugw-editfile method of /cgi-bin/wwwugw.cgi that allows a remote, authenticated user holding the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/. The CVSS 3.1 ba...

CVE-2026-75169

CVE-2026-75169 is an arbitrary file upload vulnerability in the /cgi-bin/ugwupload.cgi endpoint of MBS-Solutions X-Serie Gateway firmware V6_00_05 . A remote authenticated user with Admin role can upload files with arbitrary content to hardcoded paths , enabling full compromise (CVSS 8.8 HIGH , C...

CVE-2026-75160

An issue in X-Serie Gateway Firmware V60005 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi...

PT-2026-85411

🚨 CRITICAL: CVE-2026-69657 CVSS 9.8 XING CPTrans-ME-X uses default passwords allowing unauthorized remote access. Attackers can gain full control with no authentication required. Action: Change default credentials immediately. CVE Vulnerability PatchNow https://t.co/1Y4Tw4gKye...

CVE-2026-79418

EMX Tecnologia Gestao X versions 8.4 and earlier are affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality. The root cause is improper neutralization of user-controlled input during web page generation, allowing authenticated attackers to execute arbitrary J...

CVE-2026-79418

EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...

CVE-2026-79419

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to...

CVE-2026-75160

CVE-2026-75160 is a critical remote privilege escalation vulnerability in MBS Solutions X-Serie Gateway running Firmware V6_00_05 . The vulnerability is exploitable via the web endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi, allowing a remote, unauthenticated attacker to escalate priv...

EUVD-2026-71455

An issue in X-Serie Gateway Firmware V60005 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

EUVD-2026-71446

A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts...

CVE-2026-75164

CVE-2026-75164 is an arbitrary file read vulnerability in the /cgi-bin/ugwdownload.cgi endpoint of MBS-Solutions X-Serie Gateway firmware V6_00_05 . A remote authenticated user holding the low-privileged Standard role can retrieve arbitrary files from the device filesystem by manipulating the fil...

CVE-2026-75166

Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V60005 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution...

CVE-2026-75161

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root...

EUVD-2026-71451

An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...

CVE-2026-75162

An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentia...