CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3305 – C-DATA Web Management System User Creation access control
https://notcve.org/view.php?id=CVE-2023-3305
A vulnerability was found in C-DATA Web Management System up to 20230607. It has been classified as critical. This affects an unknown part of the file /cgi-bin/jumpto.php?class=user&page=config_save&isphp=1 of the component User Creation Handler. The manipulation of the argument user/newpassword leads to improper access controls. • https://github.com/sleepyvv/vul_report/blob/main/C-data/BrokenAccessControl.md https://vuldb.com/?ctiid.231801 https://vuldb.com/?id.231801 • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4257 – C-DATA Web Management System GET Parameter jumpto.php argument injection
https://notcve.org/view.php?id=CVE-2022-4257
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be initiated remotely. • https://github.com/siriuswhiter/VulnHub/blob/main/C-Data/rce1.md https://vuldb.com/?id.214631 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-707: Improper Neutralization •