https://vulnogram.org/ Most recent CVEs assigned by Gridware Cybersecurity (gridware). https://vulnogram.org/seaview/icons/gridware.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-29128 https://vulnogram.org/CVE-2026-29128 IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g., zebra, bgpd, ospfd, and ripd) that are owned by root but world-readable. The configuration files (e.g., zebra.conf, bgpd.conf, ospfd.… High Thu, 05 Mar 2026 05:12:35 GMT https://vulnogram.org/CVE-2026-29127 https://vulnogram.org/CVE-2026-29127 The IDC SFX2100 Satellite Receiver sets overly permissive file system permissions on the monitor user's home directory. The directory is configured with permissions 0777, granting read, write, and execute access to all local users on the system, whic… Critical Thu, 05 Mar 2026 02:36:12 GMT https://vulnogram.org/CVE-2026-29126 https://vulnogram.org/CVE-2026-29126 Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (lo… High Thu, 05 Mar 2026 01:51:06 GMT https://vulnogram.org/CVE-2026-29125 https://vulnogram.org/CVE-2026-29125 IDC SFX2100 Satalite Recievers set the `/etc/resolv.conf` file to be world-writable by any local user, allowing DNS resolver tampering that can redirect network communications, facilitate man-in-the-middle attacks, and cause denial of service. High Thu, 05 Mar 2026 01:38:18 GMT https://vulnogram.org/CVE-2026-29124 https://vulnogram.org/CVE-2026-29124 Multiple SUID root-owned binaries are found in /home/monitor/terminal, /home/monitor/kore-terminal, /home/monitor/IDE-DPack/terminal-dpack, and /home/monitor/IDE-DPack/terminal-dpack2 in International Data Casting (IDC) SFX2100 Satellite Receiver, wh… High Thu, 05 Mar 2026 01:23:35 GMT https://vulnogram.org/CVE-2026-29123 https://vulnogram.org/CVE-2026-29123 A SUID root-owned binary in /home/xd/terminal/XDTerminal in International Data Casting (IDC) SFX2100 on Linux allows a local actor to potentially preform local privilege escalation depending on conditions of the system via execution of the affected S… High Thu, 05 Mar 2026 01:18:58 GMT https://vulnogram.org/CVE-2026-29122 https://vulnogram.org/CVE-2026-29122 International Data Casting (IDC) SFX2100 satellite receiver comes with the `/bin/date` utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use… High Thu, 05 Mar 2026 00:53:24 GMT https://vulnogram.org/CVE-2026-29121 https://vulnogram.org/CVE-2026-29121 International Data Casting (IDC) SFX2100 satellite receiver comes with the `/sbin/ip` utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use… High Thu, 05 Mar 2026 00:48:59 GMT https://vulnogram.org/CVE-2026-29120 https://vulnogram.org/CVE-2026-29120 The /root/anaconda-ks.cfg installation configuration file in International Datacasting Corporation (IDC) SFX Series(SFX2100) SuperFlex Satellite Receiver insecurely stores the hardcoded root password hash. The password itself is highly insecure and s… Critical Wed, 04 Mar 2026 08:10:09 GMT https://vulnogram.org/CVE-2026-29119 https://vulnogram.org/CVE-2026-29119 International Datacasting Corporation (IDC) SFX Series SuperFlex(SFX2100) SatelliteReceiver contains hardcoded and insecure credentials for the `admin` account. A remote unauthenticated attacker can use these undocumented credentials to access the sa… High Network Exploitable Wed, 04 Mar 2026 07:58:16 GMT https://vulnogram.org/CVE-2026-28778 https://vulnogram.org/CVE-2026-28778 International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver contains undocumented, hardcoded/insecure credentials for the `xd` user account. A remote unauthenticated attacker can log in via FTP using these credentials. Because… High Network Exploitable Wed, 04 Mar 2026 07:49:10 GMT https://vulnogram.org/CVE-2026-28777 https://vulnogram.org/CVE-2026-28777 International Datacasting Corporation (IDC) SFX2100 Satellite Receiver, trivial password for the `user` (usr) account. A remote unauthenticated attacker can exploit this to gain unauthorized SSH access to the system, while intially dropped into a res… Critical Network Exploitable Wed, 04 Mar 2026 07:41:29 GMT https://vulnogram.org/CVE-2026-28776 https://vulnogram.org/CVE-2026-28776 International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver contains hardcoded credentials for the `monitor` account. A remote unauthenticated attacker can use these trivial, undocumented credentials to access the system via SS… High Network Exploitable Wed, 04 Mar 2026 07:34:30 GMT https://vulnogram.org/CVE-2026-28775 https://vulnogram.org/CVE-2026-28775 An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the `private` SNMP community string wi… Critical Network Exploitable Wed, 04 Mar 2026 07:24:50 GMT https://vulnogram.org/CVE-2026-28774 https://vulnogram.org/CVE-2026-28774 An OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inje… Critical Wed, 04 Mar 2026 07:22:57 GMT https://vulnogram.org/CVE-2026-28773 https://vulnogram.org/CVE-2026-28773 The web-based Ping diagnostic utility (/IDC_Ping/main.cgi) in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101 is vulnerable to OS Command Injection. The application insecurely p… Critical Wed, 04 Mar 2026 07:16:58 GMT https://vulnogram.org/CVE-2026-28772 https://vulnogram.org/CVE-2026-28772 A Reflected Cross-Site Scripting (XSS) vulnerability in the /IDC_Logging/index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101 allows a remote attacker to execute… Medium Network Exploitable Wed, 04 Mar 2026 07:12:53 GMT https://vulnogram.org/CVE-2026-28771 https://vulnogram.org/CVE-2026-28771 A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The application fails to adequately sa… Medium Network Exploitable Wed, 04 Mar 2026 07:11:36 GMT https://vulnogram.org/CVE-2026-28770 https://vulnogram.org/CVE-2026-28770 Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101 allows for XML Injection. The applicati… Medium Wed, 04 Mar 2026 07:06:35 GMT https://vulnogram.org/CVE-2026-28769 https://vulnogram.org/CVE-2026-28769 A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management portal version 101. An authenticated attacker can manipulate the `f… Medium Wed, 04 Mar 2026 07:02:13 GMT https://vulnogram.org/CVE-2026-1953 https://vulnogram.org/CVE-2026-1953 Nukegraphic CMS v3.1.2 contains a stored cross-site scripting (XSS) vulnerability in the user profile edit functionality at /ngc-cms/user-edit-profile.php. The application fails to properly sanitize user input in the name field before storing it in t… High Thu, 05 Feb 2026 06:33:02 GMT https://vulnogram.org/CVE-2025-14202 https://vulnogram.org/CVE-2025-14202 A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malicious SVG file with JavaScript content. When an authenticated admin user views the SVG file with embedded JavaScript code of shared bookmark,… High Wed, 17 Dec 2025 23:35:17 GMT https://vulnogram.org/CVE-2025-66269 https://vulnogram.org/CVE-2025-66269 The RupsMon and USBMate services in UPSilon 2000 run with SYSTEM privileges and contain unquoted service paths. This allows a local attacker to perform path interception and escalate privileges if they have write permissions to the directories procee… High Wed, 26 Nov 2025 01:19:18 GMT https://vulnogram.org/CVE-2025-66266 https://vulnogram.org/CVE-2025-66266 The RupsMon.exe service executable in UPSilon 2000 has insecure permissions, allowing the 'Everyone' group Full Control. A local attacker can replace the executable with a malicious binary to execute code with SYSTEM privileges or simply change the c… Critical Wed, 26 Nov 2025 01:16:40 GMT https://vulnogram.org/CVE-2025-66265 https://vulnogram.org/CVE-2025-66265 CMService.exe creates the C:\\usr directory and subdirectories with insecure permissions, granting write access to all authenticated users. This allows attackers to replace configuration files (such as snmp.conf) or hijack DLLs to escalate privileges… Medium Wed, 26 Nov 2025 01:12:50 GMT https://vulnogram.org/CVE-2025-66264 https://vulnogram.org/CVE-2025-66264 The CMService.exe service runs with SYSTEM privileges and contains an unquoted service path. This allows a local attacker with write privileges to the filesystem to insert a malicious executable in the path, leading to privilege escalation. High Wed, 26 Nov 2025 01:09:51 GMT https://vulnogram.org/CVE-2025-66263 https://vulnogram.org/CVE-2025-66263 Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in downl… High Network Exploitable Wed, 26 Nov 2025 00:52:24 GMT https://vulnogram.org/CVE-2025-66262 https://vulnogram.org/CVE-2025-66262 Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Tar extraction with -C / allo… Critical Network Exploitable Wed, 26 Nov 2025 00:50:55 GMT https://vulnogram.org/CVE-2025-66261 https://vulnogram.org/CVE-2025-66261 Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter p… Critical Network Exploitable Wed, 26 Nov 2025 00:49:38 GMT https://vulnogram.org/CVE-2025-66260 https://vulnogram.org/CVE-2025-66260 PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform SQL injection via sw1 and sw2 parameters in st… High Wed, 26 Nov 2025 00:48:34 GMT https://vulnogram.org/CVE-2025-66259 https://vulnogram.org/CVE-2025-66259 Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform in main_ok.ph… Critical Wed, 26 Nov 2025 00:46:51 GMT https://vulnogram.org/CVE-2025-66258 https://vulnogram.org/CVE-2025-66258 Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Stored XSS via crafted filenames injected… High Network Exploitable Wed, 26 Nov 2025 00:45:39 GMT https://vulnogram.org/CVE-2025-66257 https://vulnogram.org/CVE-2025-66257 Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter a… Critical Network Exploitable Wed, 26 Nov 2025 00:43:54 GMT https://vulnogram.org/CVE-2025-66256 https://vulnogram.org/CVE-2025-66256 Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in p… Critical Network Exploitable Wed, 26 Nov 2025 00:41:08 GMT https://vulnogram.org/CVE-2025-66255 https://vulnogram.org/CVE-2025-66255 Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validatio… Critical Network Exploitable Wed, 26 Nov 2025 00:39:56 GMT https://vulnogram.org/CVE-2025-66254 https://vulnogram.org/CVE-2025-66254 Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgrade paramet… High Network Exploitable Wed, 26 Nov 2025 00:37:48 GMT https://vulnogram.org/CVE-2025-66253 https://vulnogram.org/CVE-2025-66253 Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to e… Critical Network Exploitable Wed, 26 Nov 2025 00:36:29 GMT https://vulnogram.org/CVE-2025-66252 https://vulnogram.org/CVE-2025-66252 Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Infinite loop when unlink() fai… High Wed, 26 Nov 2025 00:34:11 GMT https://vulnogram.org/CVE-2025-66251 https://vulnogram.org/CVE-2025-66251 Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletehidden parameter a… High Network Exploitable Wed, 26 Nov 2025 00:32:26 GMT https://vulnogram.org/CVE-2025-66250 https://vulnogram.org/CVE-2025-66250 Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbit… Critical Network Exploitable Wed, 26 Nov 2025 00:29:57 GMT https://vulnogram.org/CVE-2025-12683 https://vulnogram.org/CVE-2025-12683 The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of… Medium Tue, 04 Nov 2025 04:23:02 GMT https://vulnogram.org/CVE-2025-1131 https://vulnogram.org/CVE-2025-1131 A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc… High Tue, 23 Sep 2025 04:31:02 GMT https://vulnogram.org/CVE-2025-2271 https://vulnogram.org/CVE-2025-2271 A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit results of other users by exploiting an Insecure Direct Object Reference (IDOR) vulnerability in the Issuetrak audit component. The vulnerability… High Thu, 13 Mar 2025 06:30:03 GMT https://vulnogram.org/CVE-2025-1135 https://vulnogram.org/CVE-2025-1135 A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the BatchWinnerEntry functionality. The CurrentFundraiser… Critical Wed, 19 Feb 2025 09:01:59 GMT https://vulnogram.org/CVE-2025-1134 https://vulnogram.org/CVE-2025-1134 A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the DonatedItemEditor functionality. The CurrentFundraiser… Critical Wed, 19 Feb 2025 08:58:08 GMT https://vulnogram.org/CVE-2025-1133 https://vulnogram.org/CVE-2025-1133 A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection vulnerability in the EditEventAttendees functionality. The EID parameter is directly conca… Critical Wed, 19 Feb 2025 08:52:43 GMT https://vulnogram.org/CVE-2025-1132 https://vulnogram.org/CVE-2025-1132 A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. The parameter is directly inserted into an SQL query without proper sanitization, allowing attackers to injec… Critical Wed, 19 Feb 2025 08:47:13 GMT https://vulnogram.org/CVE-2025-1024 https://vulnogram.org/CVE-2025-1024 A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting (XSS) in the EditEventAttendees.php page. This requires Administration privileges and affects… High Wed, 19 Feb 2025 08:34:55 GMT https://vulnogram.org/CVE-2025-1023 https://vulnogram.org/CVE-2025-1023 A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly con… Critical Tue, 18 Feb 2025 09:45:26 GMT https://vulnogram.org/CVE-2025-0981 https://vulnogram.org/CVE-2025-0981 A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript i… High Tue, 18 Feb 2025 09:33:54 GMT