CVE-2024-6333

CVE-2024-6333 - Xerox Authenticated Remote Code Execution Authenticated Remote Code Execution vulnerability in Xerox WorkCentre printers via the Network Troubleshooting Log feature. Description The Network Troubleshooting Log functionality /properties/security/networktroubleshootinglog.php fails ...

CVE-2026-1769-WriteUp

CVE-2026-1769 — Stored XSS in Xerox CentreWare Web Disclosure timeline and technical write-up for CVE-2026-1769 , a Stored Cross-Site Scripting vulnerability I identified and responsibly disclosed to Xerox. CVE record: cve.org/CVERecord?id=CVE-2026-1769 Vendor security bulletin: XRX26-003 CWE:...

CVE-2021-3438

What is included? CVE-2021-3438detection v2sccm.ps1 is a script to run via sccm to get a small report on the vulnerability of managed devices. CVE-2021-3438detection.ps1 is a script to run manually or remote on a managed device. CVE-2021-3438remediation.ps1 is a script to check and run the...

Exploit for Cross-site Scripting in Xerox Centreware_Web

CVE-2026-1769 — Stored XSS in Xerox CentreWare Web Disclosure...

Xerox CentreWare Web 7.0.6 Cross Site Scripting

Xerox CentreWare Web version 7.0.6 contains a stored cross site scripting vulnerability...

Xerox EFI Fiery Webtools LFI File Read

Reads arbitrary files via forceSave.php on Xerox DC260 EFI Fiery Controller Webtools 2.0. !/usr/bin/env python3 -- coding: utf-8 -- """Xerox EFI Fiery Controller Webtools forceSave.php pre-auth LFI file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Fuji Xerox ApeosPort - Default Login Detection

This template checks for the default credentials username: 11111, password: x-admin on Fuji Xerox ApeosPort series printers. If the credentials are valid, the response will have a 200 HTTP status code. Tested on a Fuji Xerox ApeosPort-V C2275 T2. !/usr/bin/env python3 -- coding: utf-8 -- """This...

Fuji Xerox Printer Panel - Detect

Fuji Xerox printer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fuji Xerox printer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fuji Xerox Printer Panel - Detect',...

Fuji Xerox Internet Services Panel - Detect

Fuji Xerox Internet Services panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fuji Xerox Internet Services panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fuji Xerox Internet...

Xerox Workcentre Detect

Detects Xerox Workcentre Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Xerox Workcentre Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Xerox Workcentre Detect', 'description': 'Detects Xerox...

Xerox Fuji/VersaLink Login - Panel Detection

Xerox Fuji / VersaLink Login Panel was discovered !/usr/bin/env python3 -- coding: utf-8 -- """Xerox Fuji / VersaLink Login Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Xerox Fuji/VersaLink...

Xerox DC260 EFI Fiery Controller Webtools 2.0 - Local File Inclusion Detection

Xerox DC260 EFI Fiery Controller Webtools 2.0 is vulnerable to local file inclusion because input passed thru the 'file' GET parameter in 'forceSave.php' script is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files ...

Xerox Printers Improper Authentication (CVE-2023-46327)

Multiple MFPs multifunction printers provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encrypti...

Xerox Printers Missing Authentication for Critical Function (CVE-2024-12511)

With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Xerox Printers Loop with Unreachable Exit Condition (CVE-2022-23968)

Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot, but image parsing is restarted as so...

Xerox Phaser 4622 Out-of-bounds Write (CVE-2021-37354)

Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub3226AC via the TIMEZONE variable. This vulnerability allows attackers to cause a Denial of Service DoS via crafted overflow data. This plugin only works with Tenable.ot. Please visit...

Xerox Printers Clone File OS Command Injection (CVE-2021-28673)

Xerox Phaser 6510 before 64.61.23 and 64.59.11 Bridge, WorkCentre 6515 before 65.61.23 and 65.59.11 Bridge, VersaLink B400 before 37.61.23 and 37.59.01 Bridge, B405 before 38.61.23 and 38.59.01 Bridge, B600/B610 before 32.61.23 and 32.59.01 Bridge, B605/B615 before 33.61.23 and 33.59.01 Bridge,...

Xerox Printers Remote Command Execution (CVE-2021-28671)

Xerox Phaser 6510 before 64.65.51 and 64.59.11 Bridge, WorkCentre 6515 before 65.65.51 and 65.59.11 Bridge, VersaLink B400 before 37.65.51 and 37.59.01 Bridge, B405 before 38.65.51 and 38.59.01 Bridge, B600/B610 before 32.65.51 and 32.59.01 Bridge, B605/B615 before 33.65.51 and 33.59.01 Bridge,...

Xerox WorkCentre 3550 Cleartext Storage of Sensitive Information (CVE-2022-45897)

On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored cleartext credentials associated with those settings. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Xerox AltaLink Improper Neutralization of Special Elements used in an SQL Command (CVE-2021-28668)

Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 has several SQL injection vulnerabilities. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot...