CVE-2019-7746

JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote attackers to obtain an admin token by making a /cgi-bin/qcmap_auth type=getuser request and then reading the token field. This token value can then be used to change the Wi-Fi password or perform a factory reset.

• CWE-352

• http://packetstormsecurity.com/files/151656/Jiofi-4-JMR-1140-Admin-Token-Disclosure-Cross-Site-Request-Forgery.htmlBroken Link, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46365/Broken Link, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/151656/Jiofi-4-JMR-1140-Admin-Token-Disclosure-Cross-Site-Request-Forgery.htmlBroken Link, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46365/Broken Link, Third Party Advisory, VDB Entry

Published

May 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7740An issue was discovered in Joomla! before 3.9.3. Inadequate …
• CVE-2019-7741An issue was discovered in Joomla! before 3.9.3. Inadequate …
• CVE-2019-7742An issue was discovered in Joomla! before 3.9.3. A combinati…
• CVE-2019-7743An issue was discovered in Joomla! before 3.9.3. The phar://…
• CVE-2019-7744An issue was discovered in Joomla! before 3.9.3. Inadequate …
• CVE-2019-7745JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices allow remote at…
• CVE-2019-7747DbNinja 3.2.7 allows session fixation via the data.php sessi…
• CVE-2019-7748_includes\online.php in DbNinja 3.2.7 allows XSS via the dat…
• CVE-2019-7751A directory traversal and local file inclusion vulnerability…7.5
• CVE-2019-7753Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count…
• CVE-2019-7755In webERP 4.15, the Import Bank Transactions function fails …8.8
• CVE-2019-7758Adobe Acrobat and Reader versions 2019.010.20100 and earlier…