Статьи Support
🚨 CVE-2026-113406
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
🚨 CVE-2026-113407
BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.
🚨 CVE-2026-43834
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
🚨 CVE-2026-43835
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
🚨 CVE-2026-113465
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel.
To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated...
🚨 CVE-2026-113469
A failure has been identified in the SNS during dynamic data files signature check.
A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
🚨 CVE-2026-11959
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of this vulnerability could allow an attacker to...
🚨 CVE-2026-11960
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining...
🚨 CVE-2026-43836
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
🚨 CVE-2026-43837
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
🚨 CVE-2026-43838
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
🚨 CVE-2026-43839
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
🚨 CVE-2026-43840
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.
🚨 CVE-2026-43841
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
🚨 CVE-2026-43843
An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.
🚨 CVE-2026-43844
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
🚨 CVE-2026-43845
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
🚨 CVE-2026-43846
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
🚨 CVE-2026-43847
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
🚨 CVE-2026-43848
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.