Sfx Series Superflex Satellite Receiver Web Management Interface
Approved changes feed: RSS · Atom
cpe:2.3:a:international_datacasting_corporation_(idc):sfx_series_superflex_satellite_receiver_web_management_interface:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | International Datacasting Corporation (Idc) (282b45a7-0b11-5930-9a66-e046bf74c301) |
|---|---|
| Product | Sfx Series Superflex Satellite Receiver Web Management Interface (560ae9b2-4aa9-5709-938b-07d723d47424) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-28771 |
vulnerable | 2026-06-08 07:55:15.636125 |
Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The application fails to adequately sanitize user-supplied input provided via the `cat` parameter before reflecting it in the HTTP response, allowing a remote attacker to execute arbitrary HTML or JavaScript in the victim's browser context.
Published: 2026-03-04T07:11:36.743Z
Updated: 2026-03-05T06:00:45.803Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28770 |
vulnerable | 2026-06-08 07:55:15.635560 |
XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101
Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101 allows for XML Injection. The application reflects un-sanitized user input from the `file` parameter directly into a CDATA block, allowing an authenticated attacker to break out of the tags and inject arbitrary XML elements. An actor is confirmed to be able to turn this into an reflected XSS but further abuse such as XXE may be possible
Published: 2026-03-04T07:06:35.477Z
Updated: 2026-03-05T06:01:02.877Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28769 |
not_vulnerable | 2026-06-08 07:55:15.633565 |
LFI in /IDC_Logging/checkifdone.cgi, "file" parameter Allowing for File Existence Enumeration On IDC Satellite Receiver Web Management Interface Version 101
A path traversal vulnerability exists in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management portal version 101. An authenticated attacker can manipulate the `file` parameter to traverse directories and enumerate arbitrary files on the underlying filesystem. Due to the insecure perl file path handling function in use, a authenticated actor is able to preform directory traversal, with the backup endpoint confirming a file exists by indicating that a backup operation was successful or when using the path of a non existent file, the returned status is failed.
Published: 2026-03-04T07:02:13.741Z
Updated: 2026-03-05T05:58:29.757Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.