mirror of
https://github.com/trickest/cve.git
synced 2026-11-07 04:29:23 -10:00
Update Tue Aug 4 12:41:22 UTC 2026
This commit is contained in:
trickest-workflows committed
1 parent
7ade3449b5
commit
0950a26112
107 files changed
+1197
-34
No files matched your search
@@ -10,7 +10,7 @@ Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -10,7 +10,7 @@ Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -11,6 +11,7 @@ Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac
|
||||
|
||||
#### Reference
|
||||
- http://contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html
|
||||
- http://www.redhat.com/support/errata/RHSA-2010-0834.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,7 +11,7 @@ In mhuertos phpLDAPadmin bis 665dbc2690ebeb5392d38f1fece0a654225a0b38 wurde eine
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://vuldb.com/?id.270523
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -11,6 +11,7 @@ In InvoicePlane 1.5.11, the upload feature discloses the full path of the file u
|
||||
|
||||
#### Reference
|
||||
- https://notnnor.github.io/research/2021/03/17/full-path-discloure-in-invoiceplane.html
|
||||
- https://seran.dev/research/2021/03/17/full-path-discloure-in-invoiceplane.html
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,6 +10,7 @@ The ZoomSounds plugin for WordPress is vulnerable to arbitrary file uploads due
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://sploitus.com/exploit?id=WPEX-ID:07259A61-8BA9-4DD0-8D52-CC1DF389C0AD
|
||||
- https://wpscan.com/vulnerability/07259a61-8ba9-4dd0-8d52-cc1df389c0ad
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2022-21821](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21821)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://nvidia.custhelp.com/app/answers/detail/a_id/5334
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2023-3763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3763)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in Intergard SGS 8.7.0. It has been declared as problematic. This vulnerability affects unknown code of the component SQL Query Handler. The manipulation leads to cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-234448. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
|
||||
In Intergard SGS 8.7.0 wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion der Komponente SQL Query Handler. Mittels dem Manipulieren mit unbekannten Daten kann eine cleartext transmission of sensitive information-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Die Komplexität eines Angriffs ist eher hoch. Das Ausnutzen gilt als schwierig. Der Exploit steht zur öffentlichen Verfügung.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://youtu.be/XlRVwWXpv4w
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,7 +10,7 @@ A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://sploitus.com/exploit?id=PACKETSTORM:177859
|
||||
|
||||
#### Github
|
||||
- https://github.com/ARPSyndicate/cve-scores
|
||||
|
||||
@@ -11,6 +11,7 @@ ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authentica
|
||||
|
||||
#### Reference
|
||||
- https://krashconsulting.com/fury-of-fingers-biotime-rce/
|
||||
- https://sploitus.com/exploit?id=PACKETSTORM:177859
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated att
|
||||
|
||||
#### Reference
|
||||
- https://krashconsulting.com/fury-of-fingers-biotime-rce/
|
||||
- https://sploitus.com/exploit?id=PACKETSTORM:177859
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -12,6 +12,7 @@ Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and befor
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8309098
|
||||
- https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -17,6 +17,7 @@ Issue summary: Some non-default TLS server configurations can cause unboundedmem
|
||||
|
||||
#### Reference
|
||||
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
|
||||
- https://cert-portal.siemens.com/productcert/html/ssa-354112.html
|
||||
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -26,6 +26,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: nf
|
||||
|
||||
#### Reference
|
||||
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
|
||||
- https://cert-portal.siemens.com/productcert/html/ssa-354112.html
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -14,6 +14,7 @@ SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a rem
|
||||
- http://seclists.org/fulldisclosure/2024/Jun/0
|
||||
- https://infosec-db.github.io/CyberDepot/vuln_boelter_blue/
|
||||
- https://packetstormsecurity.com/files/178978/Boelter-Blue-System-Management-1.3-SQL-Injection.html
|
||||
- https://sploitus.com/exploit?id=PACKETSTORM:178978
|
||||
|
||||
#### Github
|
||||
- https://github.com/InfoSec-DB/InfoSec-DB
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -11,7 +11,7 @@ A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to exe
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://sploitus.com/exploit?id=PACKETSTORM:181912
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -11,7 +11,7 @@ A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execut
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://sploitus.com/exploit?id=PACKETSTORM:181913
|
||||
|
||||
#### Github
|
||||
- https://github.com/fkie-cad/nvd-json-data-feeds
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2024-7915](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7915)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The application Sensei Mac Cleaner contains a local privilege escalation vulnerability, allowing an attacker to perform multiple operations as the root user. These operations include arbitrary file deletion and writing, loading and unloading daemons, manipulating file permissions, and loading extensions, among other actions.The vulnerable module org.cindori.SenseiHelper can be contacted via XPC. While the module performs client validation, it relies on the client's PID obtained through the public processIdentifier property of the NSXPCConnection class. This approach makes the module susceptible to a PID Reuse Attack, enabling an attacker to impersonate a legitimate client and send crafted XPC messages to invoke arbitrary methods exposed by the HelperProtocol interface.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://pentraze.com/vulnerability-reports
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2024-8272](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8272)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication (IPC). Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to establish a connection. This lack of proper validation allows unauthorized clients to exploit the service's methods and escalate privileges to root.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://pentraze.com/vulnerability-reports
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,6 +10,7 @@ The ZOLL ePCR IOS application reflects unsanitized user input into a WebView. At
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-041-01.json
|
||||
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-041-01
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -16,7 +16,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -10,7 +10,8 @@ The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver in
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- https://pentraze.com/vulnerability-reports/
|
||||
- https://pentraze.com/vulnerability-reports/cve-2025-4960/
|
||||
|
||||
#### Github
|
||||
- https://github.com/ARPSyndicate/cve-scores
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -23,7 +23,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -27,7 +27,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_C
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
No PoCs from references.
|
||||
- http://github.com/wolfssl/wolfssl.git
|
||||
|
||||
#### Github
|
||||
- https://github.com/17seetwice/1003_wolfssl
|
||||
|
||||
@@ -29,7 +29,7 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -12,6 +12,7 @@ A security vulnerability has been detected in code-projects Content Management S
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Limingqian123/CVE/issues/13
|
||||
- https://vuldb.com/?submit.729228
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-0588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0588)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file rockfun.php of the component API. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://vuldb.com/?id.339494
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-10526](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10526)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/f4ce1f9c-6116-4166-b995-38a099197d86/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-10882](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10882)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/503420443
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-10951](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10951)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/505191883
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-10992](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10992)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/493534964
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11010](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11010)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in WebShare in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/496266444
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11046)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/498728857
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11064](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11064)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/499075743
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11184](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11184)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/502777516
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11196)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Type Confusion in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted XML file. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/503879106
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11197](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11197)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Insufficient policy enforcement in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/504073872
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11201](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11201)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://issues.chromium.org/issues/505068950
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-11366](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11366)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/283331ca-cc2e-4c2c-9e3b-2e8c6f0c84d2/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -17,6 +17,7 @@ A flaw was found in 389 Directory Server. The SMD5 password storage plugin perfo
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bugzilla.redhat.com/show_bug.cgi?id=2485422
|
||||
- https://redhat.atlassian.net/browse/PSIRTSUPT-7600
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-12698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12698)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/b90a74b5-1694-4afc-9232-95cf092e2c98/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
### [CVE-2026-12912](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12912)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-13564](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13564)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was found in Edimax EW-7478APC 1.04. Affected is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://vuldb.com/vuln/374572
|
||||
- https://vuldb.com/vuln/374572/cti
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14816](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14816)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/72af92a2-afe6-4e5a-9a1a-6f6e97bbcd85/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14824](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14824)
|
||||
&color=blue)
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14848](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14848)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's subscription and overwrite its plan, status and expiration.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/da2ae315-a534-4ae2-a8e8-61121613437b/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14872](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14872)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/557414c2-70b9-4466-8727-d8a2c9a8a502/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-14939](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14939)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/b9a6211c-3173-4dd6-8a8d-32be248762bb/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15233](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15233)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/c0376718-4bea-4e1e-a76c-100799cb9b25/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-15958](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15958)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e424157e-b79f-4000-8dcc-51413581fdec/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16035](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16035)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/26217efe-b867-4bb9-ac7c-765fb796e2c1/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16056](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16056)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/53aec8d3-da17-4183-91b3-73b45681fd20/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16068](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16068)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/e5eecbc1-1e6b-4915-9b42-869219db8ea6/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16069](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16069)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/3fce478e-e240-46f4-b4a5-682eec11c7ad/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16070](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16070)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/aa57d5b9-ba51-476c-9e64-fd431b89fa8a/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16293](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16293)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/04aa5ba8-2654-4e71-90af-83cfd92635f8/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16295](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16295)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/ed3e613e-4bb8-45a7-8cfa-4a73aad9abc6/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16296](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16296)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/265f2edb-1c86-4b87-a59f-d5de5bf21494/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16536](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16536)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/effa5549-ecfa-45ba-9044-7345d674c2ca/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16546](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16546)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/7541bc1a-a4ea-4e02-b10a-ea59708159f4/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16547](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16547)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/373d040f-0361-4b09-9655-34d415e2c49e/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16548](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16548)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/14d5f86b-f0ab-4920-99d0-8e2a66486232/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16618)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/3754d4c0-1b67-49a4-a29a-7169446638d1/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-16623](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16623)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-68fdb2fb8f8d/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
### [CVE-2026-18220](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18220)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values (via ELF32_R_TYPE(r_info)) before indexing into the dlx_elf_howto_table[] array. The DLX relocation type number space is non-contiguous (basic types 0-6, extended types at 0x10000+), but the default case in the switch statement allows arbitrary index values to reach the array access.A specially crafted ELF/DLX object file can trigger this out-of-bounds write when processed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). The vulnerability has been demonstrated to achieve arbitrary code execution via a File Stream Oriented Programming (FSOP) attack against glibc FILE structures (stderr), redirecting control flow to system().Attack scenarios include CI/CD pipelines performing automated binary analysis, developer workstations running objdump/readelf on untrusted binaries, automated security scanning or malware analysis tools invoking binutils, and package build systems processing third-party code.Note: This vulnerability is only exploitable when binutils is built with the DLX backend enabled (typically via --enable-targets=all).
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bugzilla.redhat.com/show_bug.cgi?id=2507670
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-33591](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33591)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypasssecurity restriction using a specially crafted packet and retrieve a validsession token for the targeted account.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://www.wapt.fr/en/doc/wapt-changelog.html#wapt-2-6-0-16856-2026-06-09
|
||||
- https://www.wapt.fr/en/doc/wapt-changelog.html#wapt-2-6-1-17813-2026-06-09
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-39931](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39931)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form_step=202 parameter in backup.php. Attackers can exploit the unfiltered shell_exec invocation of the mysql command-line client to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem where MySQL FILE privileges and permissive secure_file_priv settings are configured.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://jivasecurity.com/writeups/openemr-backup-import-arbitrary-sql-cve-2026-39931
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-39932](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39932)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then executed via an unsanitized eval() call whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages, resulting in command execution as the web server user.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://jivasecurity.com/writeups/openemr-eval-rce-category-tree-cve-2026-39932
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-41452](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41452)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://jivasecurity.com/writeups/krayin-installer-bypass-account-takeover-cve-2026-41452
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-41453](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41453)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and boolean-based blind injection techniques to extract the entire database contents, including user credential hashes, CRM records, and application configuration data.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://jivasecurity.com/writeups/krayin-lead-datagrid-sqli-cve-2026-41453
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-43823](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43823)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/apple/swift-crypto/security/advisories/GHSA-8q93-f6xh-4f6f
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-43910](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43910)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directConnectHost, directConnectPort, and directConnectPath fields from the server's NEW_SESSION response and rebuilds the client's server URL from them, validating only that the protocol is https, with no host allowlist or IP validation; a rogue or compromised server can therefore redirect all subsequent session traffic to an arbitrary destination, enabling full interception of session traffic and a server-side request forgery pivot to internal hosts, including cloud metadata (IMDS) credential theft. This vulnerability is fixed in 10.1.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/appium/java-client/security/advisories/GHSA-28f5-38xr-jh2w
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-43978](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43978)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information. This issue has been fixed in version 2.6.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/wger-project/wger/security/advisories/GHSA-9qpr-vc49-hqg2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
### [CVE-2026-46384](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46384)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.When the SSH daemon is configured with the user_passwords or password option, ssh_auth:check_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the ssh_options:get_password_option/2 path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames.The user_passwords and password options are documented as intended for test purposes; the recommended alternative is pwdfun, which is not affected by this vulnerability.This vulnerability is associated with program files lib/ssh/src/ssh_auth.erl and lib/ssh/src/ssh_options.erl.This issue affects OTP from OTP 29.0 before OTP 29.0.2, corresponding to ssh from 6.0 before 6.0.1.
|
||||
Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated remote username enumeration via timing side-channel in password authentication.When the SSH daemon is configured with the user_passwords or password option, ssh_auth:check_password/3 performs a PBKDF2-SHA256 computation with 600,000 iterations (~300ms) for valid usernames, but returns immediately (~0ms) for invalid usernames via the ssh_options:get_password_option/2 path. This timing difference is detectable in a single authentication attempt and allows an unauthenticated attacker to distinguish valid from invalid usernames.The user_passwords and password options are documented as intended for test purposes; the recommended alternative is pwdfun, which is not affected by this vulnerability.This vulnerability is associated with program files lib/ssh/src/ssh_auth.erl and lib/ssh/src/ssh_options.erl.This issue affects OTP from OTP 29.0 before OTP 29.0.2, corresponding to ssh from 6.0 before 6.0.1.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -1,13 +1,18 @@
|
||||
### [CVE-2026-54891](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54891)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data.The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive in pre-handshake states when the TLS endpoint acts as a server, but does not apply the same check when the endpoint acts as a client. A network-positioned attacker can send plaintext APPLICATION_DATA records to the client during the handshake. The records are buffered and, once the handshake completes successfully, delivered to the application as if they were authenticated post-handshake data. The attacker cannot observe the client's response or steer the connection, so the impact is limited to blind injection of unauthenticated bytes. The injection window is wider for TLS versions prior to TLS 1.3 than for TLS 1.3.This vulnerability is associated with program file lib/ssl/src/tls_gen_connection.erl.This issue affects OTP from OTP 17.0 before OTP 29.0.3, OTP 28.5.0.3 and OTP 27.3.4.14, corresponding to ssl from 5.3.4 before 11.7.3, 11.6.0.3 and 11.2.12.10. TLS 1.3 is affected starting with OTP 22.0, when TLS 1.3 support was added.
|
||||
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data.The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive in pre-handshake states when the TLS endpoint acts as a server, but does not apply the same check when the endpoint acts as a client. A network-positioned attacker can send plaintext APPLICATION_DATA records to the client during the handshake. The records are buffered and, once the handshake completes successfully, delivered to the application as if they were authenticated post-handshake data. The attacker cannot observe the client's response or steer the connection, so the impact is limited to blind injection of unauthenticated bytes. The injection window is wider for TLS versions prior to TLS 1.3 than for TLS 1.3.This vulnerability is associated with program file lib/ssl/src/tls_gen_connection.erl.TLS 1.3 is affected starting with OTP 22.0, when TLS 1.3 support was added.This issue affects OTP from OTP R13B03 before OTP 27.3.4.14, from OTP 28.0 before OTP 28.5.0.3, and from OTP 29.0 before OTP 29.0.3, corresponding to ssl from 3.10.7 before 11.2.12.10, from 11.3 before 11.6.0.3, and from 11.7 before 11.7.3. Whether OTP before OTP R13B03, corresponding to ssl before 3.10.7, is affected is unknown.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -1,13 +1,18 @@
|
||||
### [CVE-2026-55953](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55953)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected.An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker.This issue affects OTP from OTP 17.0 before OTP 29.0.4, OTP 28.5.0.4 and OTP 27.3.4.15, corresponding to ssl from 5.3.4 before 11.7.4, 11.6.0.4 and 11.2.12.11.
|
||||
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls_handshake:hello/5 handler validates the negotiated protocol version and the downgrade sentinel but hands the server-chosen suite directly to ssl_handshake:handle_server_hello_extensions/9, which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446), so it is not affected.An on-path attacker between the client and the intended server can respond with a ServerHello selecting an anonymous key exchange suite such as TLS_DH_anon_* or TLS_ECDH_anon_* that the client never offered. Anonymous suites do not require the server to present a certificate, so the entire verify_peer and cacerts configuration is bypassed: the attacker completes the handshake with its own ephemeral parameters, no certificate is validated, no hostname is checked, and ssl:connect returns {ok, Socket}. All subsequent application traffic is readable and modifiable by the attacker.This issue affects OTP from OTP R13B03 before OTP 27.3.4.15, from OTP 28.0 before OTP 28.5.0.4, and from OTP 29.0 before OTP 29.0.4, corresponding to ssl from 3.10.7 before 11.2.12.11, from 11.3 before 11.6.0.4, and from 11.7 before 11.7.4. Whether OTP before OTP R13B03, corresponding to ssl before 3.10.7, is affected is unknown.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-61511](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61511)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://karmainsecurity.com/KIS-2026-13
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-64827](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64827)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://karmainsecurity.com/KIS-2026-14
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-67599](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-67599)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input through the filter parameter, which is interpolated directly into a shell command in File.php. Attackers can inject command substitution payloads into the filter parameter to execute arbitrary commands as the webconfig user, and due to extensive NOPASSWD sudo privileges granted to that user by default, immediately escalate to root.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://lazytitan.ro/clearos
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fresh connection that reuses the FTP context against an in-progress ABRT cleanup. Attackers can exploit the unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside of MTLock to cause pthread_join() to operate on an invalid thread ID, resulting in a server crash. CVE-2024-11144 identifies an incomplete fix of this vulnerability.
|
||||
LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state without holding the required mutex lock. Attackers can send a data-transfer command such as LIST followed immediately by ABOR to exploit the missing synchronization on shared context and detached thread id reuse, resulting in daemon destabilization or crash which can lead to a denial of service. The 2.3.1 patch only narrowed the timing window (an extra re-check and reordered cleanup), it never added the missing lock, so the underlying race remains.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-67608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-67608)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://karmainsecurity.com/KIS-2026-15
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-67609](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-67609)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://karmainsecurity.com/KIS-2026-16
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
Loaded 100 of 107 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user