An authenticated attacker with the user/role "Poweruser" can perform an SQL injection by accessing the /class/template_io.php file and supplying malicious GET…
The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allo…
An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters. The HTTP GET parame…
An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session managem…
The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attack…
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit D…
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit D…
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The login p…
Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File N…
The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the applicat…
The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser is run with the permissions of the roo…
The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as root without a password. Therefore, the…
If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content…
An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the ww…