Affected: orange airbox_firmware

goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.

Technical details: AirBoxAPNLeaks is a Python-based proof-of-concept exploit demonstrating CVE-2018-18375, a security vulnerability affecting Orange AirBox routers running firmware Y858_FL_01.16_04. The tool exploits an exposed HTTP endpoint (/goform/getProfileList) that leaks sensitive APN (Access Point Name) configuration details including usernames, passwords, and phone numbers without authentication. The implementation utilizes the requests library to send HTTP GET requests to the vulnerable router and parse the returned HTML content containing the leaked credentials. This vulnerability allows attackers on the local network to steal external IP addresses and mobile network authentication credentials, posing significant privacy and security risks. The repository contains a single 15-line Python script with command-line argument parsing for specifying target router IP addresses.

Affected: orange airbox_firmware

goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.

Technical details: AirBox has hidden webpage http://192.168.1.1/goform/getWlanClientInfo?rand= which prints currently connected devices ip,hostnames,mac addresses and connection time.

Affected: orange airbox_firmware

goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials.

Technical details: t: The vulnerability exists in the goform/setReset endpoint on the device web interface. Type of Vulnerability: Missing Authorization (CWE-862). The device does not enforce any authentication or authorization when accessing the reset function. Attack Mechanism: An unauthenticated attacker on the same network (or with the ability to send requests to the device) can POST to the /goform/setReset endpoint. Impact: The device is reset to factory settings. Following the reset, the attacker can log in using the default credentials (admin:admin). This can allow the attacker to take full control of the device, alter configurations, or intercept network traffic passing through the router.

Affected: ASUS RT-AC58U Firmware

CVE-2018-18287 is an information disclosure vulnerability that affects ASUS routers running specific firmware versions. The vulnerability exists in the router's web interface and allows unauthorized access to sensitive network data.

Technical details: The vulnerability is present in the main login page (Main_Login.asp) and additional pages of the router's web interface. These pages inadvertently expose:

DHCP Lease Information: Complete list of devices connected to the network, including IP addresses and hostnames Network Time Information: Current time, date, and system uptime statistics Network Topology: Details about active network clients This information is accessible without authentication, allowing any user with network access to the router's web interface to extract sensitive data about the network and connected devices.

Affected: asus rt-ac58u_firmware

A cross site scripting (XSS) vulnerability on ASUS RT-AC58U 3.0.0.4.380_6516 devices allows remote attackers to inject arbitrary web script or HTML via Advanced_ASUSDDNS_Content.asp, Advanced_WSecurity_Content.asp, Advanced_Wireless_Content.asp, Logout.asp, Main_Login.asp, MobileQIS_Login.asp, QIS_wizard.htma, YandexDNS.asp, ajax_status.xml, apply.cgi, clients.asp, disk.asp, disk_utility.asp, or internet.asp.

Technical details: The vulnerability affects multiple ASP pages including Advanced_Wireless_Content.asp, Main_Login.asp, and various other administrative components that are accessible without authentication. The exploit works by crafting a malicious URL containing JavaScript injection (e.g., 192.168.1.1/Advanced_Wireless_Content.aspn9mn0'-alert(1)-'grqb0) which the router reflects back in an unescaped script tag during the redirect to the login page. The vulnerability allows attackers to execute arbitrary JavaScript in victims' browsers when they open the prepared URL, potentially leading to session hijacking or credential theft. This is a security research repository documenting the vulnerability discovered in October 2018.

Affected: openDCIM

openDCIM v23.04 contains a SQL injection vulnerability in the rackrequest.php component. Methods such as CreateRequest and UpdateRequest construct SQL queries using unsanitized POST fields, leading to injection. An authenticated user with RackRequest or RackAdmin permissions can manipulate database query logic through affected request fields. The vulnerability may affect database confidentiality and integrity, including information disclosure and data manipulation depending on database configuration.

The source disclosure reported no official patch at publication. Use prepared statements or parameterized queries and restrict access to the RackRequest interface.

Source identifier: GCVE-115-2026-20031. Imported from the CIRCL disclosure published on 2026-11-11.

Affected: Ubilling

Multiple SQL injection vulnerabilities were identified in the api.dealwithit.php endpoint of Ubilling v1.5.8. The tariff and tariff_contains parameters and related exclude fields are concatenated into SQL statements without sanitization. The vulnerability may allow enumeration of user logins, extraction of data, or data modification depending on database configuration.

The source disclosure reported no official patch at publication. Restrict access to the API, implement prepared statements, and validate incoming parameters before database usage.

Source identifier: GCVE-115-2026-20032. Imported from the CIRCL disclosure published on 2026-11-11.

Affected: dzzoffice

A SQL injection vulnerability was discovered in the debug view-cache functionality of dzzoffice v2.4.0. The c parameter in the debug cache endpoint is incorporated into an SQL query without proper sanitization when the debug interface is enabled. Exploitation requires access to the debug endpoint and a valid debug session key. The vulnerability may disclose information from the syscache table or other database records.

The source disclosure reported no publicly available vendor patch at publication. Disable DZZ_DEBUG in production, restrict debug endpoints to trusted users, and enforce administrator access requirements.

Source identifier: GCVE-115-2026-20033. Imported from the CIRCL disclosure published on 2026-11-11. The source narrative identifies v2.4.0, while its affected-product metadata lists versions below 2.4.0.

Affected: e107 CMS

An insecure file handling / arbitrary file upload vulnerability was identified in the e107_admin/image.php Media Manager component of e107 CMS v2.3.3. Upload and remote import logic fails to enforce robust file type and content validation, allowing malicious files to be accepted. An authenticated user with media upload privileges can place crafted files in web-accessible locations. Execution or access to those files may lead to remote code execution, information disclosure, privilege escalation, and application compromise.

The source disclosure reported no official vendor fix at publication. Tighten allowed file extensions, enforce server-side content validation, disable remote URL import, and store uploaded files outside web roots.

Source identifier: GCVE-115-2026-20034. Imported from the CIRCL disclosure published on 2026-11-11. The source narrative identifies v2.3.3, while its affected-product metadata lists versions below 2.3.3.

Affected: e107 CMS

Multiple publicly accessible front-end controllers in e107 CMS reflect user-supplied HTTP GET and POST parameters into HTML responses without consistent output encoding. The source disclosure identifies affected endpoints including search.php, news.php, and user.php. An unauthenticated attacker can cause JavaScript execution in the browser context of a user who visits a maliciously crafted URL or submits a crafted request. Potential impact includes information disclosure, session hijacking, and privilege escalation.

The source disclosure reported no official vendor patch or security advisory at publication and recommended monitoring upstream changes. Apply context-appropriate output encoding to user-controlled data before rendering; WAF rules can provide an additional mitigation.

Source identifier: GCVE-115-2026-20035. Imported from the CIRCL disclosure published on 2026-11-11.