CVE-2020-36904 - Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint

CVE ID : CVE-2020-36904 Published : Dec. 31, 2025, 6:39 p.m. | 30 minutes ago Description : Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NO_LIST_EXE_PATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration, including changing admin passwords and executing system commands. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor