CVE-2024-25830

DataCube3 v1.0 suffers from an Incorrect Access Control due to an improper directory access restriction. An unauthenticated remote attacker can exploit this by sending a URI that includes the path of the configuration file, potentially extracting the root and admin passwords . Multiple connected ...

CVE-2024-31750

CVE-2024-31750 describes a SQL injection in f-logic datacube3 v1.0, exploitable remotely via the req_id parameter. The underlying issue is likely improper input handling that allows arbitrary SQL execution, leading to potential exposure of sensitive data. Connected sources consistently report the...

CVE-2024-7066

CVE-2024-7066 affects F-logic DataCube3 1.0. The vulnerability resides in the HTTP POST Request Handler, specifically the file /admin/config_time_sync.php, where manipulating the ntp_server argument enables OS command injection. Exploitation can be remote and the exploit has been disclosed public...

CVE-2024-34852

CVE-2024-34852 affects F-logic DataCube3 v1.0, where command injection occurs in the ./admin/transceiver_schedule.php file due to improper string filtering at the command execution point. An unauthenticated remote attacker can trigger the vulnerability by sending a file name containing command in...

CVE-2024-34854

CVE-2024-34854 concerns F-logic DataCube3 v1.0 with a vulnerability in the file upload mechanism exposed via the endpoint /admin/transceiver_schedule.php . The issue is a file upload vulnerability that can potentially allow attacker-controlled file uploads, contributing to a high-severity impact ...