LiquidWorm

790 exploits Active since Jun 2006
CVE-2020-36922 EXPLOITDB HIGH text WORKING POC
Sony BRAVIA Digital Signage <1.7.8 - Info Disclosure
Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details through API endpoints. Attackers can retrieve network interface information, server configurations, and system metadata by sending requests to the exposed system API.
CVSS 7.5
CVE-2020-36920 EXPLOITDB HIGH text WORKING POC
iDS6 DSSPro Digital Signage System 6.2 - Privilege Escalation
iDS6 DSSPro Digital Signage System 6.2 contains an improper access control vulnerability that allows authenticated users to elevate privileges through console JavaScript functions. Attackers can create users, modify roles and permissions, and potentially achieve full application takeover by exploiting insecure direct object references.
CVSS 8.8
CVE-2020-36918 EXPLOITDB MEDIUM text WORKING POC
iDS6 DSSPro Digital Signage System 6.2 - CSRF
iDS6 DSSPro Digital Signage System 6.2 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft malicious web pages to trick logged-in administrators into adding unauthorized users by exploiting the lack of CSRF protections.
CVSS 4.3
CVE-2020-36916 EXPLOITDB HIGH text WRITEUP
TDM Digital Signage PC Player 4.1.0.4 - Privilege Escalation
TDM Digital Signage PC Player 4.1.0.4 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files. Attackers can leverage the 'Modify' permissions for authenticated users to replace executable files with malicious binaries and gain elevated system access.
CVSS 8.8
CVE-2020-36915 EXPLOITDB HIGH text WRITEUP
Adtec Digital SignEdje <2.08.28 - Unauthenticated RCE
Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec Digital product versions.
CVSS 7.5
CVE-2020-36910 EXPLOITDB HIGH python WORKING POC
Cayin Signage Media Player 3.0 - Command Injection
Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.
CVSS 8.8
CVE-2020-36909 EXPLOITDB MEDIUM text WORKING POC
SnapGear Management Console SG560 3.1.5 - Privilege Escalation
SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the edit_config_files CGI script. Attackers can manipulate POST request parameters in /cgi-bin/cgix/edit_config_files to access and modify files outside the intended /etc/config/ directory.
CVSS 6.5
CVE-2020-36907 EXPLOITDB HIGH bash WORKING POC
Aerohive HiveOS - DoS
Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger a 5-minute service disruption.
CVSS 7.5
CVE-2020-36906 EXPLOITDB MEDIUM text WORKING POC
P5 FNIP-8x16A FNIP-4xSH 1.0.20 - CSRF
P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to add new admin users, change passwords, and modify system configurations by tricking authenticated users into loading a specially crafted form.
CVSS 4.3
CVE-2020-36905 EXPLOITDB HIGH text WORKING POC
FIBARO System Home Center 5.021 - RCE
FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or manipulate page content.
CVSS 7.5
CVE-2020-36904 EXPLOITDB HIGH text WORKING POC
Selea CarPlateServer 4.0.1.6 - RCE
Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NO_LIST_EXE_PATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration, including changing admin passwords and executing system commands.
CVSS 7.5
CVE-2020-36903 EXPLOITDB HIGH text WRITEUP
Selea CarPlateServer 4.0.1.6 - Privilege Escalation
Selea CarPlateServer 4.0.1.6 contains an unquoted service path vulnerability in the Windows service configuration that allows local users to potentially execute code with elevated privileges. Attackers can exploit the service's unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during application startup or reboot.
CVSS 8.4
CVE-2020-36902 EXPLOITDB CRITICAL text WORKING POC
UBICOD Medivision Digital Signage 1.5.1 - Auth Bypass
UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.
CVSS 9.8
CVE-2020-36901 EXPLOITDB HIGH text WORKING POC
UBICOD Medivision Digital Signage 1.5.1 - CSRF
UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new admin user with elevated privileges.
CVSS 8.8
CVE-2020-36900 EXPLOITDB HIGH text WORKING POC
All-Dynamics Digital Signage System 2.0.2 - CSRF
All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft a malicious web page that automatically submits forms to create a new user with global administrative privileges when a logged-in user visits the page.
CVSS 8.8
CVE-2020-36899 EXPLOITDB HIGH text WORKING POC
QiHang Media Web Digital Signage 3.0.9 - Info Disclosure
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive files through unverified 'filename' and 'path' parameters. Attackers can exploit the QH.aspx endpoint to read arbitrary files and directory contents without authentication by manipulating download and getAll actions.
CVSS 7.5
CVE-2020-36898 EXPLOITDB CRITICAL text WORKING POC
QiHang Media Web Digital Signage 3.0.9 - Path Traversal
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary files with web server permissions using directory traversal sequences.
CVSS 9.1
CVE-2020-36897 EXPLOITDB CRITICAL text WORKING POC
QiHang Media Web Digital Signage 3.0.9 - RCE
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.
CVSS 9.8
CVE-2020-36896 EXPLOITDB HIGH text WORKING POC
QiHang Media Web Digital Signage 3.0.9 - Auth Bypass
QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login information through an unprotected XML file. Attackers can retrieve hardcoded admin credentials by requesting the '/xml/User/User.xml' file, enabling direct authentication bypass.
CVSS 7.5
CVE-2020-36895 EXPLOITDB HIGH text WORKING POC
EIBIZ i-Media Server Digital Signage 3.8.0 - Info Disclosure
EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive configuration files via direct object reference. Attackers can retrieve the SiteConfig.properties file through an HTTP GET request, exposing administrative credentials, database connection details, and system configuration information.
CVSS 7.5
CVE-2020-36894 EXPLOITDB HIGH text WORKING POC
Eibiz i-Media Server Digital Signage 3.8.0 - Auth Bypass
Eibiz i-Media Server Digital Signage 3.8.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through AMF-encoded object manipulation. Attackers can send crafted serialized objects to the /messagebroker/amf endpoint to create administrative users without authentication, bypassing security controls.
CVSS 7.5
CVE-2020-36893 EXPLOITDB HIGH text WORKING POC
Eibiz i-Media Server Digital Signage 3.8.0 - Path Traversal
Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini.
CVSS 7.5
CVE-2020-36892 EXPLOITDB CRITICAL python WORKING POC
Eibiz i-Media Server Digital Signage 3.8.0 - Privilege Escalation
Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and take over user accounts by manipulating role settings without authentication.
CVSS 9.8
CVE-2020-36888 EXPLOITDB MEDIUM text WRITEUP
SpinetiX Fusion Digital Signage 3.4.8 - Info Disclosure
SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing the server's error responses.
CVSS 5.3
CVE-2020-36887 EXPLOITDB HIGH text WORKING POC
SpinetiX Fusion Digital Signage <3.4.8 - Info Disclosure
SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory. Attackers can access the /content/files/backups/ endpoint to download sensitive backup files containing user credentials and system information.
CVSS 7.5