Threats tagged 'ghsa-rvgw-426x-67hr'

Sunhillo SureLine versions before 9.1.5 have an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user with an active web session. This is achieved by forging a session cookie containing only a cleartext username without random identifiers or integrity protection. Attackers can guess default usernames like Admin or sftp_user to bypass login checks and potentially execute commands as root.