tag
Authenticated
MISP Core `deleteSelection` Broken Access Control — Bulk Deletion of Foreign Event Reports & Sharing Groups (CVE-2026-56423)
MISP's bulk-deletion endpoints for Event Reports (/eventReports/deleteSelection) and Sharing Groups (/sharingGroups/deleteSelection) authorize each selected item using a checkModifyCallback that discards the item id and instead returns the acting user's…
Langflow Responses API IDOR — Execute Another User's Flow (CVE-2026-55255)
Langflow's OpenAI-compatible Responses API (POST /api/v1/responses) accepts a model field that Langflow interprets as a flow ID to execute. The endpoint fails to verify that the API key making the request actually owns the flow ID supplied — so any…
Nagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Windows WMI Config Wizard (CVE-2021-25296)
Nagios XI's "Windows WMI" configuration wizard (/usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php) builds a WMI-check shell command using several attacker-supplied HTTP parameters, including pluginoutputlen. The value is never…
Nagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Switch Config Wizard (CVE-2021-25297)
Nagios XI's "Switch" configuration wizard (/usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php) generates an MRTG configuration snippet for the monitored switch and writes it into an MRTG config file using a shell sed command built from…
Nagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Cloud-VM Config Wizard (CVE-2021-25298)
Nagios XI's "Cloud/VM" configuration wizard (/usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php) performs a reachability check against an attacker-supplied host address by shelling out to ping. The address parameter is concatenated…
pgAdmin 4 Query Tool Authenticated eval() RCE (CVE-2025-2945)
pgAdmin 4's Query Tool "download" endpoint accepts a querycommited parameter and passes it directly to Python's built-in eval() without any sanitization, allowing an authenticated attacker to run arbitrary Python code under the pgAdmin service account. The…
Zyxel VMG3625-T50B Authenticated Command Injection to Root SSH Access (CVE-2026-1459)
The router's web management interface exposes a TR369Certificates CGI endpoint whose name parameter, used during a certificate "download" action, is passed unsanitized into a shell command executed as root. An authenticated administrator (or attacker with…
ZoneMinder — Second-Order SQL Injection via Event Rename (CVE-2026-27470)
ZoneMinder's event-rename functionality (web/ajax/event.php) safely stores a user-supplied event name using a parameterized query, giving no indication anything is wrong. However, the "near events" lookup (web/ajax/status.php, getNearEvents()) later reads…
Wyze Cam Pan v3 / TUTK SDK — tutk_packet_alloc Heap Overflow (CVE-2026-38698)
The tutkpacketalloc function inside the TUTK SDK's tutkavserver component, used by Wyze Cam Pan v3 and other TUTK-integrated IoT cameras, allocates a buffer for incoming AV packets based on an attacker-influenced size field without adequate bounds validation.…
Wing FTP Server Admin Session Poisoning via Lua loadfile() RCE (CVE-2026-44403)
Wing FTP Server's WebAdmin session mechanism serializes session values as executable Lua source using [[...]] long-string literals. Because bracket-sanitization code that would strip [/] characters from session values was commented out, a value containing ]]…
WeGIA Authenticated Error-Based SQL Injection Exploitation Helper (CVE-2026-23723)
WeGIA's control.php endpoint (AtendidoocorrenciaControle::listarTodosComAnexo) is vulnerable to authenticated error-based SQL injection through the idmemorando parameter. This helper script automates the tedious part of exploitation: it attempts login against…
Weblate Arbitrary File Read via ssh-keyscan Host Argument Injection — CVE-2026-24126
Weblate's SSH host-key management feature (weblate/ssh/views.py, addhostkey()) passes the administrator-supplied host field straight into an ssh-keyscan subprocess invocation with no sanitization and no -- argument terminator. Because ssh-keyscan supports a…
Veno File Manager Path Traversal to Arbitrary File Read (CVE-2026-37066)
Veno File Manager Project 4.4.9 contains a path traversal vulnerability in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php that allows an authenticated attacker with the superadmin role to disclose sensitive information via two specially crafted HTTP…
Veno File Manager Arbitrary PHP File Overwrite (CVE-2026-37068)
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the superadmin role to overwrite any PHP file in the application via a specially crafted POST request,…
Veno File Manager Arbitrary File Deletion (CVE-2026-37065)
Veno File Manager Project 4.4.9 is vulnerable to arbitrary file deletion. An authenticated attacker with the superadmin role can send a specially crafted POST request using the remove URL parameter to control which file gets deleted, with no further…
Veno File Manager 4.4.9 — Authenticated Arbitrary File Read (CVE-2026-37070)
Veno File Manager 4.4.9 exposes the /vfm-admin/ajax/streamvid.php endpoint without properly restricting which files a session-authenticated user may request. A user who is only supposed to have access to their own assigned directory can instead read any…
Veno File Manager 4.4.9 — Arbitrary File Rename to Privilege Escalation (CVE-2026-37071)
Veno File Manager 4.4.9's Actions::renameFile() function fails to restrict which files an authenticated user with rename permission can rename. By renaming the application's own vfm-admin/config.php file, an attacker triggers the application into believing it…
Tandoor Recipes Authenticated Local File Disclosure via Recipe Import (CVE-2026-25964)
CVE-2026-25964 is a path traversal / arbitrary file read vulnerability in Tandoor Recipes' recipe-import workflow. The /api/recipe-import/ endpoint lets an authenticated user set an arbitrary filepath and storage backend on a RecipeImport object without…
PbootCMS Authenticated RCE via sitecopyright Field (CVE-2026-36239)
PbootCMS's decodestring() function in apps/home/controller/ParserController.php sequentially applies stripcslashes() then htmlspecialcharsdecode() to the "Footer Information" (sitecopyright) admin field, which effectively reverses HTML-entity encoding and…
OpenWebUI "Tools" Unsandboxed exec() Remote Code Execution — CVE-2026-0766
OpenWebUI lets users extend LLM functionality by creating "Tools" containing user-submitted Python code. That code is loaded via loadtoolmodulebyid() in backend/openwebui/utils/plugin.py, which calls exec(content, module.dict) on the submitted source with…
OpenSTAManager Scadenzario Bulk Operations Error-Based SQL Injection — CVE-2026-24418
OpenSTAManager's bulk-operations handler for the Scadenzario (payment schedule) module accepts an idrecords[] array via POST at /actions.php?idmodule=18. The arrayclean() helper only strips empty values and never validates that elements are integers, so…
OpenSTAManager Prima Nota Error-Based SQL Injection — CVE-2026-24419
The Prima Nota (journal entry) module's add.php reads the iddocumenti GET parameter, splits it on commas with explode(), but never validates that the resulting elements are integers before imploding them back into a SQL IN() clause used to look up…
OpenSTAManager Global Search Amplified Time-Based Blind SQL Injection — CVE-2026-24417
OpenSTAManager's global search AJAX endpoint (/ajaxsearch.php) dispatches the user-supplied term parameter to more than ten module-specific search handlers (Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, and others), each of which…
OpenSTAManager Article Pricing Time-Based Blind SQL Injection — CVE-2026-24416
OpenSTAManager's article pricing AJAX handler (/ajaxcomplete.php?op=getprezzi) builds a UNION SQL query to pull pricing history from invoices and delivery notes. The developer correctly wrapped the idarticolo parameter in the framework's prepare() sanitizer…
OpenRemote — Expression Injection RCE in Rules Engine (CVE-2026-39842)
OpenRemote's Rules Engine evaluates user-supplied JavaScript rule expressions using the Java Nashorn scripting engine with no sandboxing, SecurityManager, or ClassFilter restrictions. While the API layer explicitly blocks non-superusers from creating Groovy…
OpenEMR EtherFax Module Authenticated Arbitrary File Read (CVE-2026-24849)
OpenEMR's Fax/SMS module ships an EtherFax integration whose disposeDoc() handler (in EtherFaxActions.php) takes an attacker-controlled filepath request parameter, checks only that the file exists, and passes it directly to readfile() with no canonicalization…
Neo4j Bolt Transaction Metadata Log Injection (CVE-2026-1337)
Neo4j writes the transaction metadata field supplied over the Bolt protocol directly into query.log without escaping control characters such as newlines. An authenticated user can therefore embed a crafted metadata value containing full fake log lines, which…
LiteLLM Guardrail Custom-Code Sandbox Escape to Root RCE (CVE-2026-40217)
LiteLLM's guardrail-testing endpoint lets authenticated users submit custom Python code that is checked with a regex-based source-code filter meant to block dangerous identifiers such as globals, builtins, and import. Because the filter only inspects source…
LatePoint Calendar Booking Plugin Contributor-to-Administrator Privilege Escalation (CVE-2026-49083)
This PoC exploits insufficient role validation in LatePoint's customer-to-WordPress-user linking logic. An authenticated attacker holding only a low-privileged "Contributor" WordPress account can create a LatePoint customer record using the email address of…
Krayin CRM — TinyMCE Upload Unrestricted File Upload to RCE (CVE-2026-38526)
Krayin CRM's TinyMCE rich-text editor upload endpoint (/admin/tinymce/upload) fails to properly restrict uploaded file types, allowing an authenticated user to bypass the upload filter using a double-extension technique and upload a PHP webshell. Once…
ITFlow Time-Based Blind SQL Injection via agent/ajax.php expires Parameter (CVE-2026-54597)
ITFlow's agent/ajax.php endpoint accepts an expires parameter that is used unsanitized in a SQL query, enabling a time-based blind SQL injection. An authenticated user can extract arbitrary database values (admin password hash, SMTP credentials, DB version)…
ITFlow SQL Injection via recurring_invoice_frequency (CVE-2026-54596)
ITFlow's recurring-invoice handling accepts an unsanitized recurringinvoicefrequency parameter that is placed directly into a SQL query. An authenticated technician-level user with access to an invoice can inject arbitrary SQL, extracting sensitive data…
Hustle (WordPress Popup) Authenticated Arbitrary File Upload via Module Import (CVE-2026-0911)
The Hustle WordPress plugin's module-import feature (actionimportmodule()) calls WordPress's core wphandleupload() with testtype => false, which disables strict file-type validation during upload. If the subsequently-imported module JSON fails validation, the…
Group-Office TNEF Attachment Handler OS Command Injection (CVE-2026-25512)
CVE-2026-25512 is an OS command injection in Group-Office's TNEF (winmail.dat) attachment handler. The email/message/tnefAttachmentFromTempFile endpoint takes a user-controlled tmpfile parameter and concatenates it, unescaped, directly into a shell exec()…
Group-Office PHP Deserialization Remote Code Execution (CVE-2026-34838)
CVE-2026-34838 is a PHP object deserialization vulnerability in Group-Office. The AbstractSettingsCollection::loadData() method calls unserialize() on a stored setting value prefixed with serialized:, without validating the object type. By storing a crafted…
Gogs Wiki Arbitrary File Deletion via Path Traversal (CVE-2026-24135)
Gogs, a self-hosted Git service written in Go, contains a path traversal flaw in the updateWikiPage function used when editing wiki pages. The function sanitizes the new page title before writing the updated file but never sanitizes the previous ("old") title…
Gogs Organization-Name Path Traversal to RCE via Git Hooks — CVE-2026-52813
Gogs fails to properly sanitize the organization name supplied at organization-creation time, allowing an authenticated attacker to embed path-traversal sequences (../../...) in the name so that it resolves outside the intended organization directory and into…
EspoCRM Authenticated RCE via Formula ACL Bypass + Attachment Path Traversal — CVE-2026-33656
EspoCRM's Formula scripting engine (Formula/action/run) can be abused by an admin-authenticated user to bypass access controls and directly rewrite the sourceId field of an Attachment record, redirecting where uploaded chunk data is written on disk via path…
EspoCRM 9.3.3 Stored HTML Injection in Email Notifications — CVE-2026-33657
EspoCRM 9.3.3 renders stream-post notification emails by converting a Note's Markdown body to HTML and inserting the result into the email template using an unescaped triple-brace placeholder ({{{post}}}), which skips HTML entity escaping normally applied by…
EspoCRM 9.3.3 Authenticated SSRF via Alternative IPv4 Loopback Notation — CVE-2026-33534
EspoCRM 9.3.3 blocks direct requests to http://127.0.0.1/... in its /api/v1/Attachment/fromImageUrl endpoint, but the underlying fetch logic does not normalize alternative IPv4 representations of the loopback address (octal, hex, decimal-dword, and…
EGroupware Nextmatch Filter Authenticated SQL Injection (CVE-2026-22243)
CVE-2026-22243 is a critical authenticated SQL injection in EGroupware's Nextmatch widget filter processing (used across modules such as InfoLog and Address Book). The application's database layer (Api\Db, Api\Storage\Base, infologso) treats array keys of the…
Dolibarr selectobject.php Authenticated Local File Inclusion (CVE-2026-34036)
Dolibarr's core/ajax/selectobject.php endpoint, used to power object-picker autocomplete widgets in the UI, accepts an objectdesc parameter that is used to build a path to a local file. An authenticated user can craft an objectdesc value (in the form…
Dolibarr ERP/CRM OS Command Injection via MAIN_ODT_AS_PDF (CVE-2026-23500)
Dolibarr's ODT-to-PDF document conversion feature builds a shell command by concatenating the admin-configurable MAINODTASPDF global setting with a sanitized filename before passing it to PHP's exec(). While the filename argument is escaped with…
DbGate `loadReader` `functionName` Injection RCE (CVE-2026-48017)
DbGate's POST /runners/load-reader endpoint takes a functionName parameter and concatenates it directly into a JavaScript template string that is later executed in a forked runner process, without sanitization or validation. An authenticated attacker can…
Chamilo LMS Authenticated RCE via Unrestricted File Upload — CVE-2026-29041
Chamilo LMS's ckuploadimage AJAX endpoint (main/inc/ajax/document.ajax.php?a=ckuploadimage) validates uploaded files solely by inspecting magic bytes via PHP's mimecontenttype(), without checking the file extension or sanitizing the stored filename. An…
Casdoor Authenticated Path Traversal to Arbitrary File Write (CVE-2026-6815)
Casdoor's Local File System storage provider fails to properly sanitize the pathPrefix configuration and fullFilePath parameter during resource uploads. An authenticated administrator (or equivalent privileged user) can use directory traversal sequences to…
Cacti Authenticated OS Command Injection via Host Notes Variable (CVE-2026-39949)
Cacti substitutes user-controlled host metadata — specifically the device "notes" field — into RRDtool command-line arguments through its variable replacement engine without sanitizing shell metacharacters. An authenticated attacker who can create devices and…
BoidCMS — Authenticated File Upload to RCE via Template Injection (CVE-2026-39387)
BoidCMS (<= 2.1.2) combines two weaknesses to reach remote code execution from an authenticated admin account. First, its media upload endpoint only checks the declared MIME type (e.g. image/gif) rather than actual file contents, allowing PHP code embedded in…
Bludit CMS API Unrestricted File Upload to RCE (CVE-2026-25099)
Bludit CMS's POST /api/files/<page-key> endpoint lets any holder of a valid API token upload files to a page without validating file extension or content, so a PHP file can be uploaded and dropped directly under the web-accessible uploads directory. Once…
Apache Superset Authenticated SQL Injection via sqlExpression/where Bypass — CVE-2026-23980
Apache Superset versions before 6.0.0 are vulnerable to an authenticated, error-based SQL injection reachable through the sqlExpression (adhoc column) or extras.where parameters of the /api/v1/chart/data REST endpoint. Superset's validateadhocsubquery()…
Apache NiFi 2.8.0 — EXECUTE_CODE Permission Bypass to Groovy RCE (CVE-2026-39816)
Apache NiFi restricts all of its 16 dedicated script-execution processors behind an EXECUTECODE permission, enforced via a @Restricted annotation. However, the optional graph bundle's TinkerpopClientService — used by the ExecuteGraphQuery /…
Cisco Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20262)
CVE-2026-20262 is an authenticated remote arbitrary file write vulnerability in the web UI of Cisco Catalyst SD-WAN Manager. Improper validation of user-supplied input during a file upload process enables path traversal, letting an authenticated attacker…
Authenticated Command Injection in LiteLLM MCP Test Endpoints (CVE-2026-42271)
CVE-2026-42271 is a command injection vulnerability in BerriAI LiteLLM's MCP preview/test endpoints — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list. These endpoints accept a full MCP server configuration in the request body, including…