CWE-89

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0544",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-05T20:00:50.990551Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-05T20:01:00.939Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:itsourcecode:school_management_system:*:*:*:*:*:*:*:*"
          ],
          "product": "School Management System",
          "vendor": "itsourcecode",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "the_better_you (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in itsourcecode School Management System 1.0. This affects an unknown part of the file /student/index.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-23T08:03:13.934Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-339331 | itsourcecode School Management System index.php sql injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.339331"
        },
        {
          "name": "VDB-339331 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.339331"
        },
        {
          "name": "Submit #728909 | itsourcecode School Management System V1.0 SQL Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.728909"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/ltranquility/CVE/issues/31"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://itsourcecode.com/"
        }
      ],
      "tags": [
        "x_freeware"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-01T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-01-01T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-01-07T00:48:24.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "itsourcecode School Management System index.php sql injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-0544",
    "datePublished": "2026-01-01T09:02:10.684Z",
    "dateReserved": "2026-01-01T09:01:20.864Z",
    "dateUpdated": "2026-02-23T08:03:13.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0501",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T04:57:09.273436Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T15:04:48.911Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP S/4HANA Private Cloud and On-Premise (Financials \ufffd General Ledger)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "S4CORE 102"
            },
            {
              "status": "affected",
              "version": "103"
            },
            {
              "status": "affected",
              "version": "104"
            },
            {
              "status": "affected",
              "version": "105"
            },
            {
              "status": "affected",
              "version": "106"
            },
            {
              "status": "affected",
              "version": "107"
            },
            {
              "status": "affected",
              "version": "108"
            },
            {
              "status": "affected",
              "version": "109"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDue to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL queries to read, modify, and delete backend database data. This leads to a high impact on the confidentiality, integrity, and availability of the application.\u003c/p\u003e"
            }
          ],
          "value": "Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL queries to read, modify, and delete backend database data. This leads to a high impact on the confidentiality, integrity, and availability of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-13T01:14:05.294Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3687749"
        },
        {
          "url": "https://url.sap/sapsecuritypatchday"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials \ufffd General Ledger)",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2026-0501",
    "datePublished": "2026-01-13T01:14:05.294Z",
    "dateReserved": "2025-12-09T22:06:42.112Z",
    "dateUpdated": "2026-02-26T15:04:48.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Advisory",
          "vendor": "Dovecot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aki Tuomi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi!\n\nWe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory will also be published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html\n\n---\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-8476\nType: CWE-403 (Exposure of File Descriptor to Unintended Control Sphere (\u0027File Descriptor Leak\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2025-11-25\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-33263\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nsubmission-login: Panic when mail_max_userip_connections is reached: Panic: epoll_ctl(del, 8) failed: Bad file \ndescriptor. When mail_max_userip_connections is set (defaul\nt 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues.\n\nRisk:\nIf running in high-security mode (default for community releases), only the new submission connection gets terminated. \nIf running in high-performance mode (default for Pr\no releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure \nfor user to send a message, or it can cause duplica\nte messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries \ncannot happen, because the crash can only happen at AUT\nH stage. No publicly available exploits are known.\n\nSolution:\nLimit the number of connections handled by single submission-login process. This has a performance impact though. \nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8874\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.0.7, OX Dovecot Pro core \u003e=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \n\u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-03-11\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ylwango613@yeswehack\nCVE: CVE-2026-33607\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nDovecot IMAP LIST match_sub() Exponential Backtracking \u2014 CPU Denial of Service. An attacker that has valid credentials \ncan use IMAP LIST command to consume CPU.\n\nRisk:\nThis can cause degradation or denial of service for IMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed \nversion.\n\n\n\n---\n\n\n\nInternal reference: DOV-8884\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-13\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nCVE: CVE-2026-27852\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nDoS by sending mail with bad header. An attacker that can send mail to a user can craft a message whose headers contain \na very large number of email addresses or MIME par\nameters, which causes excessive memory usage when the message is later parsed.\n\nRisk:\nThe message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, \ncausing denial of service for the affected user. No\n publicly available exploits are known.\n\nSolution:\nUpdate to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8941\nType: CWE-93 (Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: thanos_haruki@yeswehack\nCVE: CVE-2026-33606\nCVSS: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N)\n\nDetails:\ndsync: Mail content can cause dsync protocol injection. Mail content stored by a user can be crafted so that it is \ninterpreted as dsync protocol commands when an administ\nrator later runs dsync with the stream protocol, for example during a migration.\n\nRisk:\nInjected commands can modify mailbox state on the destination during migration or replication, including internal \nmailbox attributes that a user should not be able to set\n directly. It can also cause dsync errors. No publicly available exploits are known.\n\nSolution:\nAvoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8947\nType: CWE-655 (Insufficient Psychological Acceptability)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: heckintosh@yeswehack\nCVE: CVE-2026-33604\nCVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)\n\nDetails:\nSMTP Smuggling via Missing Dot-Stuffing After Bare Carriage Return. An attacker that can get Dovecot to relay a \nmessage, for example through Sieve redirect or submission \nrelay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message \ncontent from being interpreted as SMTP commands.\n\nRisk:\nA downstream mail server that hasn\u0027t yet fixed the SMTP smuggling vulnerability can be tricked into treating part of \nthe message body as new SMTP commands, allowing injec\ntion of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. No publicly available \nexploits are known.\n\nSolution:\nWhere you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to \nnon-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8949\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-03-24\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-40014\nCVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)\n\nDetails:\nIMAP THREAD REFERENCES O(N\u00b2) CPU DoS via Crafted References Header (index-thread-links.c). An attacker that can send \nmail to a user can craft a message header that makes \nthe IMAP THREAD command consume CPU disproportionate to the size of the message.\n\nRisk:\nWhen a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for \nIMAP. No publicly available exploits are known.\n\nSolution:\nMonitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected \nmailbox. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8991\nType: CWE-124 (Buffer Underwrite (\u0027Buffer Underflow\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-40013\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\npigeonhole: Stack Buffer Underflow in Pigeonhole ManageSieve CHECKSCRIPT/PUTSCRIPT. An attacker that has valid \ncredentials can submit a Sieve script containing an extreme\n numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script.\n\nRisk:\nThis causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for \nscript management. This might be able to be used for re\nmote code execution. No publicly available exploits are known.\n\nSolution:\nDisable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8994\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c2.3.22.2, OX Dovecot Pro core \u003e=3.0.0 \u003c3.0.7, OX Dovecot Pro core \n=3.1.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.0.7, OX Dovecot Pro core 2.3.22.2, OX Dovecot Pro core 3.1.6, OX Dovecot CE \ncore 2.4.5\nDiscovery date: 2026-04-02\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-33605\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login: Pre-auth crash. An unauthenticated attacker can crash the ManageSieve login process by sending a \nsmall malformed command before authenticating.\n\nRisk:\nIf running in high-security mode (default for community releases), only the attacker\u0027s own connection is terminated. If \nrunning in high-performance mode (default for Pro \nreleases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause \ndenial of service for Sieve script management. No \npublicly available exploits are known.\n\nSolution:\nRestrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version.\n\n\n\n---\n\n\n\nInternal reference: DOV-9039\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot Pro core \u003e=2.3.0 \u003c3.1.6, OX Dovecot CE core \u003e=2.3.0 \u003c2.4.5\nFirst fixed revision: OX Dovecot Pro core 3.1.6, OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: tipsennn@yeswehack\nCVE: CVE-2026-40018\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nMySQL multi-byte escaping wrong. None\n\nRisk:\nNone No publicly available exploits are known.\n\nSolution:\nNone\n\n\n\n---\n\n\n\nInternal reference: DOV-9041\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nAffected versions: OX Dovecot CE core \u003e=2.4.3 \u003c2.4.5\nFirst fixed revision: OX Dovecot CE core 2.4.5\nDiscovery date: 2026-04-08\nSolution date: 2026-08-26\nDisclosure date: 2026-08-26\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-4"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1050",
              "description": "CWE-1050",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-124",
              "description": "CWE-124",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-403",
              "description": "CWE-403",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-655",
              "description": "CWE-655",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-674",
              "description": "CWE-674",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:55:53Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/116"
        },
        {
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0003.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/116"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dovecot Security Advisory 3/2026",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2023-51764",
              "type": "related"
            },
            {
              "destId": "CVE-2023-51766",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27852",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33263",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33604",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33605",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33606",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33607",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40013",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40014",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40015",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40017",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40018",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40019",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40203",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40204",
              "type": "related"
            },
            {
              "destId": "CVE-2026-40205",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42007",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42008",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42391",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42392",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42393",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42395",
              "type": "related"
            },
            {
              "destId": "CVE-2026-52681",
              "type": "related"
            },
            {
              "destId": "CVE-2026-52687",
              "type": "related"
            },
            {
              "destId": "CVE-2026-73208",
              "type": "related"
            },
            {
              "destId": "CVE-2026-73209",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0382",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/116",
            "automated": true,
            "contentSha256": "01aaf8800660f758cbc04e020b53167b1553f36c4c558df09e8389481ca8dfa0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/116",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-28T10:07:32Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0382"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T11:55:53Z",
    "dateUpdated": "2026-09-11T11:55:53Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0382"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Revive Adserver Vulnerabilities",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Beccati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "========================================================================\nRevive Adserver Security Advisory                     REVIVE-SA-2026-002\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-002\n------------------------------------------------------------------------\nDate: 2026-06-03\nRisk Level: Medium to High\nApplications affected: Revive Adserver\nVersions affected: \u003c= 6.0.6\nVersions not affected: \u003e= 6.0.7\nWebsite: https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\n1. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-34912\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3650504\nhttps://github.com/revive-adserver/revive-adserver/commit/e1c9b8478\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n2. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-34913\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\nrelationships.\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3650582\nhttps://github.com/revive-adserver/revive-adserver/commit/f1b5e8504\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n3. Blind SQL Injection\n========================================================================\nVulnerability Type: CWE-89: SQL Injection\nCVE-ID: CVE-2026-34914\nRisk level: High\nCVSS Base Score: 8.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3653196\nhttps://github.com/revive-adserver/revive-adserver/commit/b541d1d05\nhttps://cwe.mitre.org/data/definitions/89.html\n\n\n========================================================================\n4. Reflected XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-34915\nRisk level: Medium\nCVSS Base Score: 6.1\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3653316\nhttps://github.com/revive-adserver/revive-adserver/commit/b541d1d05\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n5. Remote Code Execution\n========================================================================\nVulnerability Type: CWE-94: Code Injection\nCVE-ID: CVE-2026-34916\nRisk level: High\nCVSS Base Score: 8.8\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3656781\nhttps://github.com/revive-adserver/revive-adserver/commit/de3525e12\nhttps://cwe.mitre.org/data/definitions/94.html\n\n\n========================================================================\n6. Improper Authentication\n========================================================================\nVulnerability Type: CWE-287: Improper Authentication\nCVE-ID: CVE-2026-34917\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3672641\nhttps://github.com/revive-adserver/revive-adserver/commit/50c7dd3ba\nhttps://cwe.mitre.org/data/definitions/287.html\n\n\n========================================================================\n7. Stored XSS\n========================================================================\nVulnerability Type: CWE-79: Cross-site Scripting\nCVE-ID: CVE-2026-44956\nRisk level: Medium\nCVSS Base Score: 5.4\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\nProper escaping has been added to the userlog details output.\n\nReferences\n----------\nhttps://hackerone.com/reports/3669623\nhttps://github.com/revive-adserver/revive-adserver/commit/6254115b7\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n8. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-44957\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3677576\nhttps://github.com/revive-adserver/revive-adserver/commit/5860e2f86\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n9. Improper Access Control\n========================================================================\nVulnerability Type: CWE-284: Improper Access Control\nCVE-ID: CVE-2026-44958\nRisk level: Medium\nCVSS Base Score: 4.3\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3678828\nhttps://github.com/revive-adserver/revive-adserver/commit/2af365841\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n10. Remote Code Execution\n========================================================================\nVulnerability Type: CWE-94: Code Injection\nCVE-ID: CVE-2026-44959\nRisk level: High\nCVSS Base Score: 8.8\nCVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n========================================================================\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3744200\nhttps://github.com/revive-adserver/revive-adserver/commit/6c6161420\nhttps://cwe.mitre.org/data/definitions/94.html\n\n========================================================================\n11. Stored XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-44960\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\nthe username would be executed due to missing output sanitisation.\n\nResolution\n----------\nProper escaping has been added to the audit log details output.\n\nReferences\n----------\nhttps://hackerone.com/reports/3680090\nhttps://github.com/revive-adserver/revive-adserver/commit/27bb9a8f5\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n12. Incomplete List of Disallowed Inputs\n========================================================================\nVulnerability Type:    CWE-184: Incomplete List of Disallowed Inputs\nCVE-ID:                CVE-2026-44961\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\nHackerOne community member barcrange (3l4) has reported that the XML\u2011RPC API\n\nCVE\u20112025\u201155129. As a result, API users could create usernames that enabled\nimpersonation or stored XSS attacks.\n\nResolution\n----------\nProper validation has been added where it was missing.\n\nReferences\n----------\nhttps://hackerone.com/reports/3680090\nhttps://github.com/revive-adserver/revive-adserver/commit/229cf361b\nhttps://cwe.mitre.org/data/definitions/184.html\n\n\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n\u003csecurity AT revive-adserver DOT com\u003e.\n\nPlease review https://www.revive-adserver.com/security/ before doing so.\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n\n\n\n\n\n\n\n\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/0"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/184.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/284.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/287.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/89.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/94.html"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/229cf361b"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/27bb9a8f5"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/2af365841"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/50c7dd3ba"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/5860e2f86"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/6254115b7"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/6c6161420"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/b541d1d05"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/de3525e12"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e1c9b8478"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/f1b5e8504"
        },
        {
          "url": "https://hackerone.com/reports/3650504"
        },
        {
          "url": "https://hackerone.com/reports/3650582"
        },
        {
          "url": "https://hackerone.com/reports/3653196"
        },
        {
          "url": "https://hackerone.com/reports/3653316"
        },
        {
          "url": "https://hackerone.com/reports/3656781"
        },
        {
          "url": "https://hackerone.com/reports/3669623"
        },
        {
          "url": "https://hackerone.com/reports/3672641"
        },
        {
          "url": "https://hackerone.com/reports/3677576"
        },
        {
          "url": "https://hackerone.com/reports/3678828"
        },
        {
          "url": "https://hackerone.com/reports/3680090"
        },
        {
          "url": "https://hackerone.com/reports/3744200"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.revive-adserver.com/"
        },
        {
          "url": "https://www.revive-adserver.com/security/"
        },
        {
          "url": "https://www.revive-adserver.com/security/revive-sa-2026-002"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/0"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[REVIVE-SA-2026-002] Revive Adserver Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-34912",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34913",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34914",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34915",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34916",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44956",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44957",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44958",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44959",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44960",
              "type": "related"
            },
            {
              "destId": "CVE-2026-44961",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0376",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/0",
            "automated": true,
            "contentSha256": "38353b4aad227a84e5f5423124ed92bb9eccc2c021361c590c300ad74d739e41",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/0",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-03T13:43:47Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0376"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0376"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0242",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T03:56:11.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Trust Protection Foundation",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "25.3.3",
                  "status": "unaffected"
                }
              ],
              "lessThan": "25.3.3",
              "status": "affected",
              "version": "25.3.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "25.1.8",
                  "status": "unaffected"
                }
              ],
              "lessThan": "25.1.8",
              "status": "affected",
              "version": "25.1.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "24.3.6",
                  "status": "unaffected"
                }
              ],
              "lessThan": "24.3.6",
              "status": "affected",
              "version": "24.3.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "24.1.13",
                  "status": "unaffected"
                }
              ],
              "lessThan": "24.1.13",
              "status": "affected",
              "version": "24.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNo special configuration is required to be affected by this vulnerability.\u003c/p\u003e"
            }
          ],
          "value": "No special configuration is required to be affected by this vulnerability."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:trust_protection_foundation:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "25.3.3",
                  "versionStartIncluding": "25.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:trust_protection_foundation:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "25.1.8",
                  "versionStartIncluding": "25.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:trust_protection_foundation:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "24.3.6",
                  "versionStartIncluding": "24.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:trust_protection_foundation:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "24.1.13",
                  "versionStartIncluding": "24.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "other",
          "value": "Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue."
        }
      ],
      "datePublic": "2026-05-13T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform.\u003c/p\u003e"
            }
          ],
          "value": "A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePalo Alto Networks is not aware of any malicious exploitation of this issue.\u003c/p\u003e"
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "LOW",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:Y/R:U/V:C/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T19:04:52.841Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2026-0242"
        }
      ],
      "solutions": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003c/th\u003e\u003cth\u003e\u0026nbsp;Minor Version\u003c/th\u003e\u003cth\u003eSuggested Solution\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eTrust Protection Foundation 25.3\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003cspan\u003e25.3.0 through 25.3.2\u003c/span\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 25.3.3 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eTrust Protection Foundation 25.1\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003cspan\u003e25.1.0 through 25.1.7\u003c/span\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 25.1.8 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eTrust Protection Foundation 24.3\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003cspan\u003e24.3.0 through 24.3.5\u003c/span\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 24.3.6 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eTrust Protection Foundation 24.1\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003cspan\u003e24.1.0 through 24.1.12\u003c/span\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 24.1.13 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older versions\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "Version                             Minor Version            Suggested Solution\nTrust Protection Foundation 25.3    25.3.0 through 25.3.2    Upgrade to 25.3.3 or later.\nTrust Protection Foundation 25.1    25.1.0 through 25.1.7    Upgrade to 25.1.8 or later.\nTrust Protection Foundation 24.3    24.3.0 through 24.3.5    Upgrade to 24.3.6 or later.\nTrust Protection Foundation 24.1    24.1.0 through 24.1.12   Upgrade to 24.1.13 or later.\nAll older versions                                           Upgrade to a supported fixed version."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-13T16:00:00.000Z",
          "value": "Initial publication."
        }
      ],
      "title": "Trust Protection Foundation: SQL Injection Vulnerability",
      "x_affectedList": [
        "Trust Protection Foundation 25.3.0",
        "Trust Protection Foundation 25.3.1",
        "Trust Protection Foundation 25.3.2",
        "Trust Protection Foundation 25.1.0",
        "Trust Protection Foundation 25.1.1",
        "Trust Protection Foundation 25.1.2",
        "Trust Protection Foundation 25.1.3",
        "Trust Protection Foundation 25.1.4",
        "Trust Protection Foundation 25.1.5",
        "Trust Protection Foundation 25.1.6",
        "Trust Protection Foundation 25.1.7",
        "Trust Protection Foundation 24.3.0",
        "Trust Protection Foundation 24.3.1",
        "Trust Protection Foundation 24.3.2",
        "Trust Protection Foundation 24.3.3",
        "Trust Protection Foundation 24.3.4",
        "Trust Protection Foundation 24.3.5",
        "Trust Protection Foundation 24.1.0",
        "Trust Protection Foundation 24.1.1",
        "Trust Protection Foundation 24.1.2",
        "Trust Protection Foundation 24.1.3",
        "Trust Protection Foundation 24.1.4",
        "Trust Protection Foundation 24.1.5",
        "Trust Protection Foundation 24.1.6",
        "Trust Protection Foundation 24.1.7",
        "Trust Protection Foundation 24.1.8",
        "Trust Protection Foundation 24.1.9",
        "Trust Protection Foundation 24.1.10",
        "Trust Protection Foundation 24.1.11",
        "Trust Protection Foundation 24.1.12"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2026-0242",
    "datePublished": "2026-05-13T19:04:52.841Z",
    "dateReserved": "2025-11-03T20:44:03.175Z",
    "dateUpdated": "2026-05-15T03:56:11.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Security Advisory",
          "vendor": "Dovecot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aki Tuomi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dear subscribers,\n\nwe\u0027re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those \nvulnerabilities. This advisory is also published at \nhttps://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html\n\n\n---\n\n\nClassification: TLP:GREEN\n\nInternal reference: DOV-7830\nType: CWE-1250 (Improper Preservation of Consistency Between Independent Representations of Shared State)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.1\nDiscovery date: 2025-07-24\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: Erik  \u003cerik () broadlux com\u003e\nCVE: CVE-2025-30189\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\nv2.4 regression: auth cache broken with several passdb / userdb. When cache is enabled, some passdb/userdb drivers \nincorrectly cache all users with same cache key, causing wrong cached information to be used for these users.\n\nRisk:\nAfter cached login, all subsequent logins are for same user. No publicly available exploits are known.\n\nSolution:\nInstall fixed version or disable caching either globally or for the impacted passdb/userdb drivers.\n\n\n\n---\n\n\n\nInternal reference: DOV-8349\nType: CWE-20 (Improper Input Validation)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.1.2, OX Dovecot CE core 2.4.3\nDiscovery date: 2025-11-04\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nCVE: CVE-2025-59028\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nInvalid base64 authentication can cause DoS for other logins. When sending invalid base64 SASL data, login process is \ndisconnected from the auth server, causing all active authentication sessions to fail.\n\nRisk:\nInvalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. No publicly available exploits \nare known.\n\nSolution:\nInstall fixed version or disable concurrency in login processes (heavy perfomance penalty on large deployments).\n\n\n\n---\n\n\n\nInternal reference: DOV-8508\nType: CWE-20 (Improper Input Validation)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3\nDiscovery date: 2025-11-29\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nCVE: CVE-2025-59032\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nv2.4/v3.1 regression: Pigeonhole: ManageSieve panic occurs with sieve-connect as a client. ManageSieve AUTHENTICATE \ncommand crashes when using literal as SASL initial response.\n\nRisk:\nThis can be used to crash ManageSieve service repeatedly, making it unavailable for other users. No publicly available \nexploits are known.\n\nSolution:\nControl access to ManageSieve port, or disable the service if it\u0027s not needed. Alternatively upgrade to a fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8584\nType: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.3, OX Dovecot Pro core 2.3.22.1\nDiscovery date: 2025-12-29\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: cavid@yeswehack\nCVE: CVE-2025-59031\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\ndecode2text.sh OOXML extraction may follow symlinks and read unintended files during indexing. Dovecot has provided a \nscript to use for attachment to text conversion. This script unsafely handles zip-style attachments.\n\nRisk:\nAttacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and \nsubsequently ending up in FTS indexes. No publicly available exploits are known.\n\nSolution:\nDo not use the provided script, instead, use something else like FTS tika.\n\n\n\n---\n\n\n\nInternal reference: DOV-8591\nType: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nDiscovery date: 2026-01-07\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: strokep@yeswehack\nCVE: CVE-2026-0394\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\nauth: Path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`Pre-auth \npath traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`. When dovecot \nhas been configured to use per-domain passwd files, and they are placed one path component above /etc, or slash has \nbeen added to allowed characters, path traversal can happen if the domain component is directory partial.\n\nRisk:\nThis allows inadvertently reading /etc/passwd (or some other path which ends with passwd). If this file contains \npasswords, it can be used to authenticate wrongly, or if this is userdb, it can unexpectly make system users appear \nvalid users.  No publicly available exploits are known.\n\nSolution:\nUpgrade to fixed version, or use different authentication scheme that does not rely on paths. Alternatively you can \nalso ensure that the per-domain passwd files are in some other location, such as /etc/dovecot/auth/%d.\n\n\n\n---\n\n\n\nInternal reference: DOV-8775\nType: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-20\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: cookiejack15@yeswehack\nCVE: CVE-2026-27860\nCVSS: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\nDetails:\nv2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject \narbitrary LDAP filter to Dovecot\u0027s LDAP authentication.\n\nRisk:\nThis leads to potentially bypassing restrictions and allows probing of LDAP structure. No publicly available exploits \nare known.\n\nSolution:\nDo not clear out auth_username_chars, or install fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8781\nType: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027))\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-23\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: whisperer@yeswehack\nCVE: CVE-2026-24031\nCVSS: 7.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)\n\nDetails:\nv2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed \nwhen auth_username_chars is cleared by admin.\n\nRisk:\nThis vulnerability allows bypassing authentication for any user and user enumeration. No publicly available exploits \nare known.\n\nSolution:\nDo not clear auth_username_chars. If this is not possible, install latest fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8787\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 3.0.2, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4\nDiscovery date: 2026-02-24\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: djvirus@yeswehack\nCVE: CVE-2026-27859\nCVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nv3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing \nexcessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU.\n\nRisk:\nA suitably formatted mail message causes mail delivery process to consume large amounts of CPU time. No publicly \navailable exploits are known.\n\nSolution:\nUse MTA capabilities to limit RFC 2231 MIME parameters in mail messages, or upgrade to fixed version where the \nprocessing is limited.\n\n\n\n---\n\n\n\nInternal reference: DOV-8816\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-02-27\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: whisperer@yeswehack\nCVE: CVE-2026-27857\nCVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)\n\nDetails:\nimap-login: Excessive memory usage DoS. Sending \"NOOP (((...)))\" command with 4000 parenthesis open+close results in \n~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for \nlonger time periods by not sending the command ending LF. So attacker could connect possibly from even a single IP and \ncreate 1000 connections to allocate 1 GB of memory, which would likely result in reaching VSZ limit and killing the \nprocess and its other proxied connections.\n\nRisk:\nAttacker could connect possibly from even a single IP and create 1000 connections to allocate 1 GB of memory, which \nwould likely result in reaching VSZ limit and killing the process and its other proxied connections. No publicly \navailable exploits are known.\n\nSolution:\nInstall fixed version, there is no other remediation.\n\n\n\n---\n\n\n\nInternal reference: DOV-8818\nType: CWE-400 (Uncontrolled Resource Consumption)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0, OX Dovecot Pro core 3.1.0, OX Dovecot CE core 2.4.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-02-28\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: ilyar@yeswehack\nCVE: CVE-2026-27858\nCVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nDetails:\nmanagesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes \nmanagesieve to allocate large amount of memory.\n\n\nRisk:\nAttacker can force managesieve-login to be unavailable by repeatedly crashing the process. No publicly available \nexploits are known.\n\nSolution:\nProtect access to managesieve protocol, or install fixed version.\n\n\n\n---\n\n\n\nInternal reference: DOV-8830\nType: CWE-287 (Improper Authentication)\nComponent: core\nReport confidence: Confirmed\nSolution status: Fixed by vendor\nLast affected revision: OX Dovecot Pro core 2.3.0\nFirst fixed revision: OX Dovecot Pro core 3.0.5, OX Dovecot CE core 2.4.3, OX Dovecot Pro core 3.1.4, OX Dovecot Pro \ncore 2.3.22.1\nDiscovery date: 2026-03-04\nSolution date: 2026-03-27\nDisclosure date: 2026-03-27\nResearcher credits: bksparajuli@yeswehack\nCVE: CVE-2026-27856\nCVSS: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)\n\nDetails:\ndoveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is \nsusceptible to timing oracle attack. An attacker can use this to determine the configured credentials.\n\nRisk:\nFiguring out the credential will le"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1250",
              "description": "CWE-1250",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-294",
              "description": "CWE-294",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-90",
              "description": "CWE-90",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:15:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/13"
        },
        {
          "url": "https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Dovecot Security Advisory OXDC-2026-0001",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-30189",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59028",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59031",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59032",
              "type": "related"
            },
            {
              "destId": "CVE-2026-0394",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24031",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27855",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27856",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27857",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27858",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27859",
              "type": "related"
            },
            {
              "destId": "CVE-2026-27860",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0235",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/13",
            "automated": true,
            "contentSha256": "cd1c4fc48637eb40c941400f57d5835f8f7b88c32c348352184aedfe5768d08a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-27T08:06:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0235"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-11T11:15:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0235"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Linksys MX9600/MX4200 -",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Christian Z\u00e4ske via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SYSS-2025-009\nProduct:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0MR9600, MX4200 (and potentially others)\nManufacturer:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Linksys\n\nTested Version(s):\u00a0 \u00a0 \u00a0 \u00a0 \u00a01.0.4.205530 for MR9600, 1.0.13.210200 for MX4200\nVulnerability Type:\u00a0 \u00a0 \u00a0 \u00a0 SQL Injection (CWE-89)\nRisk Level:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 High\nSolution Status:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Open\nManufacturer Notification: 2025-03-18\nSolution Date:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0-\nPublic Disclosure:\u00a0 \u00a0 \u00a0 \u00a0 \u00a02026-02-12\nCVE Reference:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0Not yet assigned\nAuthor of Advisory:\u00a0 \u00a0 \u00a0 \u00a0 Christian Z\u00e4ske, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nLinksys MX4200 is a Wi-Fi mesh router targeting home users.\n\nThe manufacturer describes the product as follows (see [1]):\n\n\"This router supports the latest Wi-Fi\u00ae 6 (802.11ax) standard for\nnext-level streaming and gaming. Its powerful WiFi 6 mesh coverage\noffers faster WiFi performance for lag-free online gaming and\nsimultaneous streaming to every device and corner of your home.\"\n\nDue to improper neutralization of special elements, SQL statements can\nbe injected via the handshake of a TLS-SRP connection. This can be used\nto inject known credentials into the database. These credentials can be\nutilized to successfully complete the handshake and use the protected\nservice.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe Linksys MX4200 (and other models) provides a service (sct_server\nbinary) running on TCP port 6060 (all interfaces except WAN), which is\nused to integrate other mesh devices into the network. The service\naccepts TLS-SRP connections with a username and password.\n\nThe service uses a different script (smcdb_auth) to receive credential\ninformation from an SQLite databse using the given username. Since the\nservice does not properly neutralize special elements in the username,\narbitrary SQL statements can be injected. This can be used to insert\nknown credentials into the correct database table, which then provide\naccess to the protected service (sct_server).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nUsing the \"tlslite-ng\" library, the following Python code will inject\nknown credentials into the \"authorize\" table of the used SQLite database.\nThese credentials can be used to access the service.\n\n\u00a0 from socket import *\n\u00a0 from tlslite.api import *\n\u00a0 from tlslite import *\n\n\u00a0 N, g, salt, verifier = VerifierDB.makeVerifier(\"SySS\", \"SySS\", 1024)\n\u00a0 verifier_bytes = verifier.to_bytes(128)\n\n\u00a0 sock = socket.socket(AF_INET, SOCK_STREAM)\n\u00a0 sock.connect((\"192.168.1.1\", 6060))\n\n\u00a0 conn = TLSConnection(sock)\n\u00a0 try:\n\n\u00a0 except:\n\u00a0 \u00a0 \u00a0 pass\n\n\u00a0 for byte in verifier_bytes:\n\u00a0 \u00a0 \u00a0 sock = socket.socket(AF_INET, SOCK_STREAM)\n\u00a0 \u00a0 \u00a0 sock.connect((\"192.168.1.1\", 6060))\n\u00a0 \u00a0 \u00a0 conn = TLSConnection(sock)\n\u00a0 \u00a0 \u00a0 try:\n\n\u00a0 \u00a0 \u00a0 except:\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 pass\n\n\nAfter the code is executed, the TLS-SRP handshake will successfully\ncomplete when authenticating with the username \"SySS\" and the\npassword \"SySS\".\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThere is no known solution yet.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2025-01-30: Vulnerability discovered\n2025-03-18: Vulnerability reported to manufacturer\n2025-04-07: First response from manufacturer\n2025-04-14: Requested an update from manufacturer\n2025-05-06: Acknowledgment of vulnerabilities by the manufacturer\n2026-02-12: Public disclosure\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] Product website for Linksys MX4200\n\u00a0 \u00a0 https://support.linksys.com/kb/article/952-en/\n[2] SySS Security Advisory SYSS-2025-009\nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt\n[3] SySS Responsible Disclosure Policy\n\u00a0 \u00a0 https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Christian Z\u00e4ske of SySS\nGmbH.\n\nE-Mail: christian.zaeske () syss de\n\nKey ID: 0x7B00D164A32F9AC9\nKey Fingerprint: 51D4 6E9B 3C29 7347 AC01 0F5A 7B00 D164 A32F 9AC9\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 3.0\nURL: https://creativecommons.org/licenses/by/3.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/12"
        },
        {
          "url": "https://creativecommons.org/licenses/by/3.0/deed.en"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.linksys.com/kb/article/952-en/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        },
        {
          "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-009.txt"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2025-009] Linksys MX9600/MX4200 - SQL Injection",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0201",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/12",
            "automated": true,
            "contentSha256": "d646c0810ab896ea8950905e0c13345bf317a514066c6a6bb89c083058e07519",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-12T10:12:50Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:09:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0201"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Gemini",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in\nGemini 7.3.0.\n\nType: Authenticated SQL injection to xp_cmdshell RCE (CWE-89)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)\nImpact: Authenticated user executes OS commands via stacked SQL and xp_cmdshell as sa/sysadmin\nAuthentication: authenticated\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/countersoft-gemini-sqli-xp-cmdshell-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/74"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/74"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/countersoft-gemini-sqli-xp-cmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/74"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Gemini 7.3.0 Authenticated SQL injection to xp_cmdshell RCE (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0150",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/74",
            "automated": true,
            "contentSha256": "1e992764fbc072fd1ca5b1f5320f15498c8ab96d0754f3285c0ea12d196e4a2c",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/74",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-19T05:01:11Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0150"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Leostream Connection Broker",
          "vendor": "Leostream",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing two vulnerabilities in Leostream Connection Broker 9.1.37.0.\n\nVulnerability 1 \u2014 Authenticated SQL injection to webshell to root RCE (CVSS 9.1, \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-89)\n\ncall_back.pl?action=user concatenates the unsigned _where parameter into a PostgreSQL WHERE clause; the default \ninstallation grants SUPERUSER, runs postgres as the webroot owner, and configures NOPASSWD sudo, so lo_export writes a \nwebshell and /welcome.pl?c= triggers commands as root.\n\nVulnerability 2 \u2014 Unauthenticated rogue-agent registration + SSRF (CVSS 7.0, \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-306)\n\nServer.Register is dispatched without the session gate and its token check is optional, letting an anonymous caller \ninject VM records and drive broker outbound TLS connections to attacker-controlled hosts.\n\nAuthentication: Vulnerability 1 authenticated (requires valid session); Vulnerability 2 unauthenticated / pre-auth.\n\nFull technical analyses and reproducible proofs-of-concept:\n  https://0day-rubbish.com/blog/leostream-postauth-sqli-lo-export-webshell-rce\n  https://0day-rubbish.com/blog/leostream-unauth-server-register-ssrf\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE IDs are pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:08:09Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/96"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/96"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/leostream-postauth-sqli-lo-export-webshell-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/leostream-unauth-server-register-ssrf"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/96"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Leostream Connection Broker 9.1.37.0 two vulnerabilities (SQLi to root RCE, unauth SSRF)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0137",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/96",
            "automated": true,
            "contentSha256": "1cf8d2c5db456ca635e632c66da234db75b4b9ab7d593e5251eaa7d5b7786b04",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/96",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T17:11:24Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-09T10:08:09Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0137"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Delta DIAEnergie IEMS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Delta DIAEnergie IEMS V1.11.\n\nType: Authenticated (conditional) SQL injection to VBScript RCE (CWE-89)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\nImpact: Remote code execution in the CEBC service context, giving control of energy-management data and PLC \nconnectivity in industrial facilities.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/delta-diaenergie-iems-postauth-commandtag-sqli-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/95"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/95"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/delta-diaenergie-iems-postauth-commandtag-sqli-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/95"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Delta DIAEnergie IEMS V1.11 Authenticated (conditional) SQL injection to VBScript RCE (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0136",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/95",
            "automated": true,
            "contentSha256": "0f9bac918acaeb844f5025ffc5671be63b6cf6a465a652545d4e3943651dc39f",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/95",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T17:11:08Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0136"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}