Vendor
SMA
7 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
Medium 6.5
SMA: Directory Traversal in Sunny Boy <3.10.27.R
An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices.
-
Medium 6.5
SMA: Sunny Portal limited disclosure of personal data of registered users to an authenticated user
A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.
-
Medium 6.5
SMA: Sunny Portal Remote Code Execution
An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user.
-
Medium 5.4
SMA: SQL injection in Sunny Central UP
An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device.
-
Medium 6.4
Clickjacking vulnerability in Sunny Webbox
Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack on Sunny WebBox firmware version 1.6.1 and earlier.