CVE-2020-36904
Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NO_LIST_EXE_PATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration, including changing admin passwords and executing system commands.
Vendor
-
Product
-
CWE
Yayın Tarihi
2025-12-31 19:15:41
Güncelleme
2025-12-31 20:42:15
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-