Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54203— TeamDavid: Memory Leak leaking sensitive information

CVSS 9.2 · Critical EPSS 0.56% · P43

Possible ATT&CK Techniques 1AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProductVersion RangeStatus
Tobit Laboratories AGTeamDavid≤ Rollout 524affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-54203

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
TeamDavid: Memory Leak leaking sensitive information
Source: CVE Program / CVE List V5
Vulnerability Description
Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting this endpoint, an attacker can access sensitive information, including user passwords. Exploitation does not require authentication. This issue affects TeamDavid through Rollout 524.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

VendorProductAffected VersionsCPESubscribe
Tobit Laboratories AGTeamDavid 0 ~ Rollout 524 -

II. Public POCs for CVE-2026-54203

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54203

请登录查看更多情报信息。

Vendor Pages for CVE-2026-54203 (1)

Same Patch Batch · Tobit Laboratories AG · 2026-08-07 · 22 CVEs total

CVE-2026-542109.5 CRITICALTeamDavid: Buffer Overflow in file names of file upload functionalities
CVE-2026-542119.5 CRITICALTeamDavid: Buffer Overflow in multiple form data parameters
CVE-2026-542129.5 CRITICALTeamDavid: Buffer Overflow in JSON-parsing
CVE-2026-542139.2 CRITICALTeamDavid: Denial of Service via endpoint 'internalRestart'
CVE-2026-542098.9 HIGHTeamDavid: Buffer Overflow in 'editini' function
CVE-2026-542188.8 HIGHTeamDavid: Weak Cryptography and Insecure Password Storage
CVE-2026-542028.5 HIGHTeamDavid: Path Traversal in the archive creation functionality
CVE-2026-542088.5 HIGHTeamDavid: Arbitrary File Write leading to Stored XSS
CVE-2026-120708.4 HIGHTeamDavid: Arbitrary File Deletion via form field 'scjob'
CVE-2026-542008.4 HIGHTeamDavid: Local File Inclusion via the form field 'scjob'
CVE-2026-542047.7 HIGHTeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search funct
CVE-2026-542016.9 MEDIUMTeamDavid: Missing Authorization
CVE-2026-542056.3 MEDIUMTeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing fun
CVE-2026-542066.3 MEDIUMTeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending function
CVE-2026-542076.3 MEDIUMTeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive fun
CVE-2026-542155.3 MEDIUMTeamDavid: Open Redirect via the 'replyUrl' parameter
CVE-2026-541995.3 MEDIUMTeamDavid: Header Injection through request body in link storing functionality
CVE-2026-542145.3 MEDIUMTeamDavid: Header Injection through the 'cType' URL parameter
CVE-2026-542165.3 MEDIUMTeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameter
CVE-2026-542175.3 MEDIUMTeamDavid: Stored XSS in web application

Showing top 20 of 22 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: TeamDavid
Same vendor: Tobit Laboratories AG
Same weakness: CWE-200

V. Comments for CVE-2026-54203

No comments yet

Leave a comment