CVE-2023-2759

TapHome core platform before version 2023.2 contains a hidden API vulnerability that lets an authenticated, low-privilege user change other users’ passwords, potentially giving full device access. This is documented across CVE-2023-2759 entries (NVD/Red Hat) and aligns with the vendor’s disclosur...

CVE-2023-2760

CVE-2023-2760 : TapHome core is affected by an SQL injection in the HandleMessageUpdateDevicePropertiesRequest function, exploitable before version 2023.2. Low-privileged users can inject arbitrary SQL into queries, potentially achieving read access to data, with possible limited write access and...