https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 02:30:27 +0000 https://vulnerability.circl.lu/vuln/cve-2026-54200 <p><strong>Affected:</strong> Tobit Laboratories AG TeamDavid</p> <p>Tobit Laboratories AG TeamDavid&#39;s Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an &#39;@@attach&#39; command in the form field &#39;scjob&#39;, files can be attached to a message, which can then be downloaded by an authenticated user. A filter is in place that restricts access to the David con-fig folder and the user folder. However, this filter can be bypassed by specifying an alternate data stream, allowing the download of sensitive files such as other users&#39; access files containing their passwords or the server&#39;s private key. This issue affects TeamDavid before Rollout 528.</p> <p>Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.</p> <p><strong>Affected:</strong> Tobit Laboratories AG TeamDavid</p> <p>Tobit Laboratories AG TeamDavid&#39;s Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an &#39;@@attach&#39; command in the form field &#39;scjob&#39;, files can be attached to a message, which can then be downloaded by an authenticated user. A filter is in place that restricts access to the David con-fig folder and the user folder. However, this filter can be bypassed by specifying an alternate data stream, allowing the download of sensitive files such as other users&#39; access files containing their passwords or the server&#39;s private key. This issue affects TeamDavid before Rollout 528.</p> <p>Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.</p> https://vulnerability.circl.lu/vuln/cve-2026-54200