Ilevia Srl. vulnerabilities
We track 12 vulnerabilities in Ilevia Srl. products across 2 products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2025.
Latest Ilevia Srl. vulnerabilities
- 7.5 High severity
EVE X1 Server: Use of a Broken or Risky Cryptographic Algorithm
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an insecure hashing algorithm vulnerability. The product stores passwords using the MD5 hash function without applying a per‑password salt. Because MD5 is a fast, unsalted hash, an attacker who obt
- 7.5 High severity
EVE X1 Server: Improper Limitation of a Pathname to a Restricted Directory
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a relative path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers not
- 7.5 High severity
EVE X1 Server: Improper Limitation of a Pathname to a Restricted Directory
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an absolute path traversal vulnerability in get_file_content.php that allows an attacker to read arbitrary files. Ilevia has declined to service this vulnerability, and recommends that customers no
- 9.8 Critical severity
EVE X1 Server: Use of Default Credentials
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends that customers not expo
- 9.8 Critical severity
EVE X1 Server: Execution with Unnecessary Privileges
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends t
- 8.8 High severity
EVE X1 Server: Improper Neutralization of Special Elements used in an OS Command
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain authenticated OS command injection vulnerabilities in multiple web-accessible PHP scripts that call exec() and allow an authenticated attacker to execute arbitrary commands. Ilevia has declined to
- 9.8 Critical severity
EVE X1 Server: Improper Neutralization of Special Elements used in an OS Command
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends
- 8.8 High severity
EVE X1/X5 Server: Improper Neutralization of Special Elements used in an OS Command
Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can rep
- 9.8 Critical severity
EVE X1/X5 Server: Improper Neutralization of Special Elements used in an OS Command
Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized input is passed to a system() call for authentication, allowing attackers to inject special characters and manipulate command parsing. Because
- 7.5 High severity
EVE X1 Server: Improper Limitation of a Pathname to a Restricted Directory
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a pre-authentication file disclosure vulnerability via the 'db_log' POST parameter. Remote attackers can retrieve arbitrary files from the server, exposing sensitive system information and credentials.
- 9.8 Critical severity
EVE X1 Server: Improper Neutralization of Special Elements used in an OS Command
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote attackers can execute arbitrary system commands by injecting payloads into the 'passwd' HTTP POST parameter, l
- 7.5 High severity
EVE X1 Server: Insertion of Sensitive Information into Log File
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and