Advisories · Technology
traccar.
Every CVE that names traccar among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Traccar: Authentication bypass via path parameters exposes protected device media
- traccar
- Information disclosure
- Authentication bypass
- CVSS 2.3 Low
Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback
- Traccar
- Cross-site request forgery (CSRF)
- CVSS 7.6 High
Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion
- Traccar
- CWE-640
- CVSS 6.5 Medium
Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle
- traccar
- Denial of service
- CVSS 7.1 High
Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions
- traccar
- SQL injection
- CVSS 5.3 Medium
Traccar: Missing edit authorization on device image upload allows read-only users to write files
- traccar
- Broken access control
- CVSS 5.4 Medium
traccar allows stored HTML injection in notification emails
- traccar
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
traccar allows XML injection in KML and GPX exports
- traccar
- Other injection
- CVSS 6.5 Medium
traccar allows CSV formula injection via exported position data
- traccar
- Other injection
- CVSS 7.3 High
Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints
- traccar
- Cross-site request forgery (CSRF)
- Open redirect
- CVSS 8.7 High
Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload
- traccar
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 6.5 Medium
Traccar vulnerable to Path Traversal and External Control of File Name or Path
- traccar
- Path traversal
- CVSS 7.1 High
Traccar Missing Origin Validation in WebSockets
- traccar
- CWE-1385
- CVSS 8.7 High
Traccar Unauthenticated Local File Inclusion on Windows - Leakage of Traccar Config File
- traccar
- Path traversal
- CVSS 9.7 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution
- traccar
- Unrestricted file upload
- CVSS 8.5 HighCritical · CVSS 7+ and EPSS
Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type
- traccar
- Unrestricted file upload
- CWE-27
- CVSS 8.5 High
An unrestricted file upload vulnerability in traccar leads to RCE
- traccar
- Unrestricted file upload
- CVSS 5.5 Medium
Unquoted Windows binary path in Traccar
- traccar
- CWE-428
- CVSS 7.7 High
LDAP injection vulnerability in Traccar GPS Tracking System
- Traccar
- Other injection