Product
XWEB EVO versions 4.3.0 through 5.8.8 are vulnerable to unauthenticated arbitrary file write via crafted POST requests, enabling configuration tampering or denial of service.