A βCWE-256: Plaintext Storage of a Passwordβ affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext unless specific security measures at other layers (e.g., full-disk encryption) have been enabled.
4.6CVSS
4.6AI Score
0.001EPSS
A βCWE-352: Cross-Site Request Forgery (CSRF)β can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page.
8.3CVSS
7.2AI Score
0.0005EPSS
A βCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')β allows malicious users to permanently inject arbitrary Javascript code.
8.8CVSS
7.2AI Score
0.0005EPSS
A βCWE-201: Insertion of Sensitive Information Into Sent Dataβ affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext when an administrative session is open in the browser.
4.6CVSS
7AI Score
0.001EPSS