https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:02:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318924 EUVD-2026-318924 https://cve.radiocsirt.org/vuln/euvd-2026-318924 https://cve.radiocsirt.org/vuln/fkie_cve-2025-34518 <p>Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.</p> <p>Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-34518 https://cve.radiocsirt.org/vuln/ghsa-vgch-v2fr-f5q3 <p>Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.</p> <p>Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to the internet.</p> https://cve.radiocsirt.org/vuln/ghsa-vgch-v2fr-f5q3 https://cve.radiocsirt.org/vuln/icsa-26-036-04 <p>Ilevia EVE X1 Server contains a pre-authentication file disclosure vulnerability via the &#39;db_log&#39; POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials. Ilevia EVE X1 Server contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the &#39;passwd&#39; HTTP POST parameter, leading to full system compromise or denial of service. Ilevia EVE X1 Server contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential reuse. Ilevia EVE X1/X5 Server contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for authentication, allowing attackers to inject special characters and manipulate command parsing. Due to the binary&#39;s interpretation of non-zero exit codes as successful authentication, remote attackers can bypass authentication and gain full access to the system. Ilevia EVE X1/X5 Server contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with malicious payloads. Execution with sudo grants fu…</p> <p>Ilevia EVE X1 Server contains a pre-authentication file disclosure vulnerability via the &#39;db_log&#39; POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials. Ilevia EVE X1 Server contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the &#39;passwd&#39; HTTP POST parameter, leading to full system compromise or denial of service. Ilevia EVE X1 Server contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential reuse. Ilevia EVE X1/X5 Server contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for authentication, allowing attackers to inject special characters and manipulate command parsing. Due to the binary&#39;s interpretation of non-zero exit codes as successful authentication, remote attackers can bypass authentication and gain full access to the system. Ilevia EVE X1/X5 Server contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with malicious payloads. Execution with sudo grants fu…</p> https://cve.radiocsirt.org/vuln/icsa-26-036-04