Pascal Keul

The issue allows an authenticated low-privileged user to embed malicious Javascript code, potentially gaining admin rights when an admin user visits the vulnerable website. This is a case of local privilege escalation.

The issue allows an attacker to open a reverse shell with root privileges.

The issue allows an attacker to gain knowledge by reading insufficiently protected sensitive information, which can be used to plan further attacks.

A SQL injection issue allows unauthenticated remote attackers to execute arbitrary SQL commands. This is achieved via the `user id` parameter in a "/login/forgot1" POST request.

The issue concerns the Log module in SECUDOS DOMOS, which allows local file inclusion.

The issue affects the Log module, allowing for cross-site scripting (XSS) attacks.

The issue allows unauthenticated remote attackers to disclose password hashes of GUI users through the User.getUserPWD method. This can be exploited by attackers with access to the web interface.

The issue allows remote attackers to read arbitrary files of the device's filesystem through Directory Traversal or Arbitrary File Read. This can be exploited by unauthenticated attackers with access to the web interface.

A reflected Cross-Site scripting issue allows remote attackers to inject arbitrary web scripts or HTML via the `username` parameter to the "Login Form" API endpoint.