rootpwn

high · CVSS v3 7.5 · CVSS v4 8.7

CVE-2026-47097

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attacke…

Description

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly available firmware image to recover the shared passphrase and decrypt diagnostics export bundles retrieved from the unauthenticated diagnostics endpoint on any affected device, exposing highly sensitive server information.

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
8.7
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-97253

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

View analysis

high

CVE-2026-97271

Unauthenticated cross‑site scripting (XSS) exists in WPFunnels plugin versions up to 3.13.1, allowing attackers to inject malicious scripts into pages viewed by any user. The flaw can be triggered without authentication, making it trivial for an attacker to target site visitors. It is a high‑severity vulnerability with a CVSS v3 score of 7.1.

View analysis

high

CVE-2026-97272

Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

View analysis