Threat Intelligence Database

CVE-2026-14952 is a high-severity vulnerability in Frauscher Sensortechnik's FDS 102 version 2.1.0. It allows unauthenticated remote attackers to access sensitive files on the FDS Web server over HTTP without requiring a valid session. The exposed files include backup archives and other downloads that contain detailed railway signaling and track layout information, which should be protected from unauthorized access.

CVE-2026-14950 is a critical vulnerability in Frauscher Sensortechnik FDS 102 version 2.1.0 where an unauthenticated remote attacker with a valid session identifier can continue using the session after it should have expired. This flaw increases the risk of unauthorized continued access to the FDS web interface if session identifiers are stolen, leaked, shared, or left unattended.

CVE-2026-14949 is a high-severity authorization vulnerability in Frauscher Sensortechnik FDS 102 version 2.11.0. A low privileged remote attacker with a valid session can exploit the user creation API endpoint to create new user accounts with arbitrary roles, including the highest privilege level. This flaw allows unauthorized privilege escalation within the application.

CVE-2026-14947 is a path traversal vulnerability in Frauscher Sensortechnik FDS 102 version 2.8.0. A high-privileged remote attacker can upload a malicious ZIP archive containing directory traversal sequences (e.g., ../) that allows escaping the intended extraction directory. This improper validation of archive entry paths can lead to arbitrary file writes on the server, potentially enabling arbitrary code execution and full system compromise.

CVE-2026-14946 is a high-severity vulnerability in Frauscher Sensortechnik FDS 102 version 2.8.0. It allows a high privileged remote attacker to upload a .php file due to improper file type validation. The attacker can then directly request the uploaded .php file from the /uploads/ directory to execute arbitrary code, potentially leading to full system compromise.