traccar server vulnerabilities

Latest traccar server CVEs

Newest publication first

1. CVE-2024-7746 Use of default credentials at Traccar fleet management solution

   Published 2024-08-13

   Critical·CVSS 9.5 EPSS 0.53%

   Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwise be protected by the authentication mec...

2. CVE-2019-5748 In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.

   Published 2019-01-09

   Critical·CVSS 9.8 EPSS 1.7%

   In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.

3. CVE-2018-1000881 Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in ComputedAttributesHandler.java that can result in Remote Co...

   Published 2018-12-20

   Critical·CVSS 9.8 EPSS 3.8%

   Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in ComputedAttributesHandler.java that can result in Remote Command Execution. This attack appear to be exploitable via Remote: web applicatio...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.