Статьи Support
🚨 CVE-2026-49005
The root password hash of the device can be obtained through unencrypted information in the firmware.
🚨 CVE-2026-49007
By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.
🚨 CVE-2026-49008
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.
🚨 CVE-2026-66491
Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability.
🚨 CVE-2026-66492
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability.
🚨 CVE-2026-66493
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.
🚨 CVE-2026-54199
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the
request body in the application's link storing functionality
(//ServerClient_celink.htm), which is appended to the redirect target in
the 302 HTTP response. If a line feed is added...
🚨 CVE-2026-54200
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in
the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message,
which can then be downloaded by an...
🚨 CVE-2026-54201
Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks
when serving these log files. As a result, attackers can obtain
sensitive error information or internal application details, potentially
aiding in further attacks. This issue...
🚨 CVE-2026-54202
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the
archive creation functionality. Because the archive path is
user-controlled and insufficiently validated, an attacker can manipulate
the input to traverse directories. This allows...
🚨 CVE-2026-54203
Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds
with memory. By repeatedly
requesting this endpoint, an attacker can...
🚨 CVE-2026-54204
Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot”
parameter, which can be set to network locations using UNC paths (e.g.,
“\\Server\Share”). The server processes these paths without validation,
resulting in outbound connection attempts...
🚨 CVE-2026-54205
Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm)
accepts a “pathname” parameter, which can be set to network locations
using UNC paths (e.g., “\\Server\Share”). The server processes these
paths without validation, resulting in...
🚨 CVE-2026-54206
Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a
@@INCLUDE command, which can be set to network locations using UNC paths
(e.g., “\\Server\Share”). The server processes these paths without
validation, resulting in outbound...
🚨 CVE-2026-54207
Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts
an arbitrary path, which can be set to network locations using UNC paths
(e.g., “\\Server\Share”). The server processes these paths without
validation, resulting in outbound...
🚨 CVE-2026-54208
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an
unauthenticated attacker to create or write into existing files on the
server with attacker-controlled content. This is possible because user
input is written directly to...
🚨 CVE-2026-54209
Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by
including the string "(editini)" in the file path, writing the new
password to the specified "Archive.ini" file. However, the application
does not verify that the...
🚨 CVE-2026-54210
Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are
vulnerable to a buffer overflow condition. By specifying an excessively
long filename in a file upload request, an unauthenticated attacker can
trigger a crash of the...
🚨 CVE-2026-54211
Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a
buffer overflow vulnerability in multiple form data parameters. By
submitting excessively long values in these parameters, an authenticated
attacker can trigger a...
🚨 CVE-2026-54212
Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a
buffer overflow condition. By submitting a specially crafted JSON body,
such as one that is at least 8 characters long and begins with a number,
an unauthenticated attacker...
Защита от мошенничества: Использование посредника минимизирует риски столкнуться с «продавцами-однодневками» или недобросовестными заказчиками, которые исчезают после получения предоплаты или результата работы.