Vulnerabilidades de AMTT
CVEs publicadas que afetam produtos de AMTT: 4 registro(s), com severidade, exploração e correções.
CVE-2026-7697
Média · 4.7
CWE-74 03/05/2026
AMTT Hotel Broadband Operation System cardhand_submit.php sql injection
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected is an unknown function of the file /manager/card/cardhand_submit.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-14090
Alta · 7.2
CWE-89 05/12/2025
AMTT Hotel Broadband Operation System cardmake_down.php sql injection
A security flaw has been discovered in AMTT Hotel Broadband Operation System 1.0. This affects an unknown part of the file /manager/card/cardmake_down.php. Performing manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-13123
Crítica · 9.8
CWE-89 13/11/2025
AMTT Hotel Broadband Operation System get_firstdate.php sql injection
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. The impacted element is an unknown function of the file /user/portal/get_firstdate.php. Executing manipulation of the argument uid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-12253
Crítica · 9.8
CWE-74 27/10/2025
AMTT Hotel Broadband Operation System get_expiredtime.php sql injection
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/portal/get_expiredtime.php. This manipulation of the argument uid causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.