CVE-2026-101265

LowCVSS 3.1/10Last modified Sep 29, 2026

Description

A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such manipulation leads to inclusion of sensitive information in source code. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

VendorProductVersions
IntelbrasTIP 125i4.3.35; 4.3.41

References

Timeline

Published
Sep 29, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1012661.3A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.CVE-2026-1012672.7A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some speCVE-2026-1012681.7If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the CVE-2026-1012692.3The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is usedCVE-2026-101276.3A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of thCVE-2026-1012702.1Malicious HTML content could be injected into the help texts of various fields with organizer permissions.CVE-2026-1012712.1OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is CVE-2026-1012722.3The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session CVE-2026-1012735.3Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was noCVE-2026-1012746.9When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate theCVE-2026-1012756.3Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status resCVE-2026-1012769.2iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees s
CVE-2026-101265: Low severity, CVSS 3.1 | Vulnix