Threat Intelligence Database

CVE-2026-14952 is a high-severity vulnerability in Frauscher Sensortechnik's FDS 102 product. It allows unauthenticated remote attackers to access sensitive files on the FDS Web server without valid authentication. Specifically, attackers can retrieve backup archives and other files containing detailed railway signaling and track layout information over HTTP. This exposure of critical infrastructure data poses significant confidentiality risks.

CVE-2026-14950 is a critical vulnerability in Frauscher Sensortechnik's FDS 102 product where an unauthenticated remote attacker with a valid session identifier can continue to use the session after it should have expired. This flaw allows unauthorized continued access to the FDS web interface, increasing the risk from stolen, leaked, shared, or unattended sessions.

CVE-2026-14949 is an authorization vulnerability in Frauscher Sensortechnik FDS 102 that allows a low privileged remote attacker with a valid session to create new user accounts with arbitrary roles, including the highest privilege level. This flaw exists in the user creation functionality exposed via /api/user/add.php. The vulnerability affects versions from 2.11.0 up to and including 2.13.3. The CVSS 4.0 base score is 8.5, indicating high severity.

CVE-2026-14947 is a path traversal vulnerability in Frauscher Sensortechnik FDS 102 that allows a high-privileged remote attacker to upload a malicious ZIP archive containing directory traversal sequences (e.g., ../). This enables the attacker to escape the intended extraction directory and write files to arbitrary locations on the server. Improper validation of archive entry paths before writing files to disk can lead to arbitrary code execution and potentially full system compromise. The vulnerability affects versions from 2.8.0 up to and including 2.13.3. The CVSS 4.0 score is 8.6, indicating high severity. No patch or remediation details are provided in the input data.

CVE-2026-14946 is a high-severity vulnerability in Frauscher Sensortechnik FDS 102 that allows a high privileged remote attacker to upload a .php file due to improper file type validation. This uploaded file can then be accessed directly to execute arbitrary code, potentially leading to full system compromise. The affected versions include 2.8.0 through 2.13.3. No patch or remediation information is currently provided.