Vulnerabilidades de Selea
CVEs publicadas que afetam produtos de Selea: 7 registro(s), com severidade, exploração e correções.
Izero Box Full Firmware 5Izero Column Entry/8 Firmware 5Izero Column Full/8 Firmware 5Targa 504 Firmware 5Targa 512 Firmware 5Targa 704 Ilb Firmware 5Targa 704 Tkm Firmware 5Targa 710 Inox Firmware 5Targa 750 Firmware 5Targa 805 Firmware 5Targa Semplice Firmware 5Carplateserver 5Selea CarPlateServer (CPS) 2Selea Targa IP OCR-ANPR Camera 1
CVE-2020-36904
Alta · 7.5
CWE-306 31/12/2025
Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint
Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NO_LIST_EXE_PATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration, including changing admin passwords and executing system commands.
CVE-2020-36903
Alta · 8.4
CWE-428 31/12/2025
Selea CarPlateServer 4.0.1.6 Local Privilege Escalation via Unquoted Service Path
Selea CarPlateServer 4.0.1.6 contains an unquoted service path vulnerability in the Windows service configuration that allows local users to potentially execute code with elevated privileges. Attackers can exploit the service's unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during application startup or reboot.
CVE-2021-47731
Crítica · 9.8
CWE-306 09/12/2025
Selea Targa IP Camera Developer Backdoor Configuration Overwrite
Selea Targa IP OCR-ANPR Camera contains a hard-coded developer password vulnerability that allows unauthorized configuration access through an undocumented page. Attackers can exploit the hidden endpoint by using the hard-coded password 'Selea781830' to enable configuration upload and overwrite device settings.
CVE-2021-47730
Alta · 8.8
CWE-352 09/12/2025
Selea Targa IP Camera Cross-Site Request Forgery via Admin Creation
Selea Targa IP OCR-ANPR Camera contains a cross-site request forgery vulnerability that allows attackers to create administrative users without authentication. Attackers can craft a malicious web page that submits a form to add a new admin user with full system privileges when a logged-in user visits the page.
CVE-2021-47729
Média · 5.4
CWE-79 09/12/2025
Selea Targa IP Camera Stored Cross-Site Scripting via Files List
Selea Targa IP OCR-ANPR Camera contains a stored cross-site scripting vulnerability in the 'files_list' parameter that allows attackers to inject malicious HTML and script code. Attackers can send a POST request to /cgi-bin/get_file.php with crafted payload to execute arbitrary scripts in victim's browser session.
CVE-2021-47728
Crítica · 9.8
CWE-78 09/12/2025
Selea Targa IP Camera Remote Code Execution via Utils
Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell commands. Attackers can exploit the 'addr' and 'port' parameters to inject commands and gain www-data user access through chained local file inclusion techniques.
CVE-2021-47727
Média · 5.3
CWE-306 09/12/2025
Selea Targa IP Camera Unauthenticated Stream Disclosure
Selea Targa IP OCR-ANPR Camera contains an unauthenticated vulnerability that allows remote attackers to access live video streams without authentication. Attackers can directly connect to RTP/RTSP or M-JPEG streams by requesting specific endpoints like p1.mjpg or p1.264 to view camera footage.