4 results · Clear filters · Feed
-
Critical 9.1
Dixell/Copeland XWEB EVO Unauthenticated Configuration Write via config.lua
XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which perfor…
-
Critical 9.8
Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgi
XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter,…
-
Critical 9.8
Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password
XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevo…
-
Critical 9.8CVE-2026-124002 Public exploit
Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Username
XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua,…