My personnal CVEs Pokedex and my Preferred Way to Spend Time
LIST OF Reported CVE
CVE-2026-41466
Stored XSS via checkValidHtmlText()
CVE-2026-41466
CVSS 5.1
ProjeQtor
An XSS vulnerability has been identified: user input is returned without proper encoding, allowing JavaScript injection and execution in the browser. The current regex-based filtering is insufficient and can be bypassed
24 avril 2026
CVE-2026-41467
Stored XSS via checkValidFileName()
CVE-2026-41467
CVSS 5.1
ProjeQtor
The application allows file uploads without proper validation, including HTML files that may contain JavaScript. The filename validation function does not block these extensions or inspect content, potentially enabling client-side code execution.
24 avril 2026
CVE-2026-60121
Unauthenticated Command Injection via the `/admin/ajax/ping.php` Endpoint
CVE-2026-60121
CVSS 9.8
Vitec
A critical command injection vulnerability was discovered in the `admin/ajax/ping.php` endpoint of the Vitec administration interface. Although user input is properly protected using `escapeshellarg()`, the `/usr/share/commands/ping` script reuses this value without escaping before executing it via `shell_exec()`. This flaw allows an unauthenticated attacker to inject arbitrary commands and execute them with root privileges on the server.
11 juillet 2026
CVE-2026-61498
Unauthenticated Command Injection via the `/admin/ajax/gen_graphs.php` Endpoint
CVE-2026-61498
CVSS 9.8
Vitec
An OS command injection vulnerability exists in the gen_graphs.php component of the Vitec Flamingo device. The start, end, key, and format HTTP GET parameters are incorporated into a shell command without proper neutralization of special characters before being passed to passthru(). The affected endpoint does not require authentication, allowing a remote unauthenticated attacker to execute arbitrary operating system commands. Because the web server context has passwordless sudo access to root privileges on the affected device, successful exploitation can result in arbitrary command execution with root privileges, leading to full system compromise.
11 juillet 2026
CVE-2026-61514
Unauthenticated Full Camera Take Over
CVE-2026-61514
CVSS 9.8
Puwell
The proprietary protocol exposed on TCP port 23456 does not implement any authentication mechanism, allowing an attacker to issue commands by sending specially crafted TCP packets.
14 juillet 2026
CVE-2026-61515
Unauthenticated remote code execution (RCE)
CVE-2026-61515
CVSS 9.8
Puwell
A vulnerability affects all Puwell camera components. A debugging interface (DebugShell) remains enabled in production firmware, allowing unauthenticated attackers to execute commands with root privileges
