CVE-2018-8770

Cobub Razor 0.8.0 is affected by CVE-2018-8770, a physical path leakage information disclosure. The issue arises via multiple test-related PHP files and fixtures (e.g., generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/post...

CVE-2018-7745

CVE-2018-7745 affects Western Bridge Cobub Razor 0.7.2. The vulnerability is a missing authentication for the URL /index.php?/install/installation/createuserinfo, allowing account creation without login. Attackers could create a new user (superuser) through a crafted POST request, as shown by pub...

CVE-2022-36747

Razor v0.8.0 contains a cross-site scripting (XSS) vulnerability in the uploadchannel() function (CVE-2022-36747). The issue affects Razor version 0.8.0 and is caused by insecure handling in the uploadchannel() path, enabling attacker-controlled input to be reflected in the web context. Public re...

CVE-2018-7746

Cobub Razor 0.7.2 suffers an authentication bypass on /index.php?/manage/channel/modifychannel, enabling stored XSS triggered when an admin performs a subsequent /index.php?/manage/channel request. Evidence in multiple sources shows a craftable channel_name payload (e.g., xss), illustrating the v...

CVE-2024-28421

CVE-2024-28421 affects Razor 0.8.0. The vulnerability is a SQL Injection in ChannelModel::updateapk within channelmodle.php, which could let a remote attacker escalate privileges. In confirmed third-party sources, mitigation guidance for Razor v0.8.0 includes disabling the ChannelModel::updateapk...

CVE-2018-8056

CVE-2018-8056 affects Cobub Razor 0.8.0. The vulnerability is a physical path leakage caused by an invalid channel_name parameter to /index.php?/manage/channel/addchannel or a direct request to /export.php, exposing internal file paths that could aid information disclosure. Connected references i...

CVE-2019-10276

CVE-2019-10276 affects Western Bridge Cobub Razor 0.8.0. The vulnerability is a file upload issue reachable via the URI web/assets/swf/uploadify.php; demonstration involves uploading a PHP file served with the image/jpeg content type. The connected records confirm the affected product and the upl...

CVE-2018-7720

The CVE-2018-7720 entry details a CSRF vulnerability in Western Bridge Cobub Razor 0.7.2, exploitable via /index.php?/user/createNewUser/ to create new accounts without proper authorization. The underlying issue is cross-site request forgery that permits account creation, with impact described as...