XWEB EVO (< 5.6.2)

XWEB EVO contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field.

XWEB EVO before 5.6.2 contains a hardcoded backdoor password that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account.