Research

Unauthenticated blind OS command injection via the custom SYSTEM protocol

Unauthenticated read/write access to PSIA API endpoints

Unauthenticated live camera snapshots on TCP port 6688

BusyBox Telnet enabled by default with root shell exposure

Unauthenticated disclosure of plaintext device credentials

Plaintext storage of Wi-Fi credentials in ifcfg.wlan0

Missing authorization to plugin administration endpoints affecting cache, meta-tag, and contact-form settings

Authenticated low-privileged users can create draft posts by bypassing role checks on the drafts endpoint

Authenticated users can execute arbitrary Ruby code through select_eval custom field command input

Stored XSS by injecting HTML in draft titles that is rendered in the admin drafts listing

Server-side template injection through the settings test_email action (ERB evaluated in email context)

Authenticated SQL injection via crafted slug values in post create/edit flows

Stored XSS via unsanitized cama_contact_form before_html content in contact-form editing

Unauthenticated access to admin-gated AJAX dispatch endpoints via header/path bypass

Unauthenticated persistent remote code execution via crafted install request payload

Unauthenticated PHP object injection through a crafted maxsite_comuser cookie value