https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 12:06:43 +0000 https://vulnerability.circl.lu/vuln/cve-2026-54208 <p><strong>Affected:</strong> Tobit Laboratories AG TeamDavid</p> <p>Tobit Laboratories AG TeamDavid&#39;s Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm), containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528.</p> <p>Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.</p> <p><strong>Affected:</strong> Tobit Laboratories AG TeamDavid</p> <p>Tobit Laboratories AG TeamDavid&#39;s Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm), containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528.</p> <p>Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.</p> https://vulnerability.circl.lu/vuln/cve-2026-54208