https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T18:49:11.646512+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-105324 CVE-2026-105324 — An HTTP header injection vulnerability was found in the ADM 2026-10-07T18:49:11.647732+00:00

Affected: ASUSTOR Inc. ADM

An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. By sending a crafted HTTP request with injected headers via the state parameter, the attacker can leverage the underlying web server's X-Sendfile mechanism to retrieve sensitive files without authentication. Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RWC1 as well as from ADM 5.0.0 through ADM 5.1.4.RL21.