GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Organization

Vulnerability Disclosure Archive

GNA-1988
GNA identifier
GNA-1988 GCVE registry Recent publications
Registered on 2026-09-04, last updated on 2026-09-10.

Recent vulnerabilities

387 GCVE records assigned by this organization as GNA-1988

GCVE-1988-2026-0126

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Authenticated RCE (second-order SQL injection) in Lansweeper 12.2.1.0 (web reports 12.2.1.6) (Lansweeper)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Lansweeper 12.2.1.0 (web reports 12.2.1.6) (Lansweeper). The research is published and a proof-of-concept is available. Authenticated RCE (second-order SQL injection) (CVSS 8.8, authenticated) Lansweeper 12.2.1.0 contains a second-order SQL injection in the LicenseActions console. A SQL Server sub-server name containing a single quote is stored and later concatenated unescaped into a NOT LIKE clause; the query is executed with stacked statements, enabling EXEC xp_cmdshell. The default lansweeperuser database account is SQL Server sysadmin and xp_cmdshell is enabled by default, so an authenticated administrator achieves remote code execution. Dynamically verified. Impact: Full compromise of the Lansweeper server. The attacker can execute arbitrary commands, read scanned asset and credential data, and pivot into the managed network. Advisory: https://0day-rubbish.com/blog/lansweeper-licenseactions-sqli-xpcmdshell-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Security advisory Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Lansweeper 12.2.1.0 (web reports 12.2.1.6) \n(Lansweeper). The research is published and a proof-of-concept is available.\n\nAuthenticated RCE (second-order SQL injection) (CVSS 8.8, authenticated)\n\nLansweeper 12.2.1.0 contains a second-order SQL injection in the LicenseActions console. A SQL Server sub-server name \ncontaining a single quote is stored and later concatenated unescaped into a NOT LIKE clause; the query is executed with \nstacked statements, enabling EXEC xp_cmdshell. The default lansweeperuser database account is SQL Server sysadmin and \nxp_cmdshell is enabled by default, so an authenticated administrator achieves remote code execution. Dynamically \nverified.\n\nImpact: Full compromise of the Lansweeper server. The attacker can execute arbitrary commands, read scanned asset and \ncredential data, and pivot into the managed network.\n\nAdvisory: https://0day-rubbish.com/blog/lansweeper-licenseactions-sqli-xpcmdshell-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:19Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/63"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/63"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/lansweeper-licenseactions-sqli-xpcmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/63"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Authenticated RCE (second-order SQL injection) in Lansweeper 12.2.1.0 (web reports 12.2.1.6) (Lansweeper)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0126",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/63",
            "automated": true,
            "contentSha256": "b79a652e47cb35bc955ae62909cd8888ae1638681369ff80f25aed940287ed33",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/63",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:09Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:19Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0126"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0125

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Authenticated RCE (command injection) in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI Software)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI Software). The research is published and a proof-of-concept is available. Authenticated RCE (command injection) (CVSS 8.8, authenticated) Kerio Connect 10.0.9 Patch 2 contains a command-injection vulnerability in the WebAdmin JSON-RPC method Server.startEncryption. The password parameter is double-quoted and concatenated unescaped into a cryptsetup shell command that is executed via system() during volume encryption. Because the mail server process runs as root, a FullAdmin user can break out of the quotes and execute arbitrary commands as root. Dynamically verified. Impact: Arbitrary command execution as root on the mail server host. An attacker with admin access can read mail stores and credentials, disrupt mail service, and take full control of the server. Advisory: https://0day-rubbish.com/blog/kerio-connect-startencryption-cmd-injection-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Security advisory Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI \nSoftware). The research is published and a proof-of-concept is available.\n\nAuthenticated RCE (command injection) (CVSS 8.8, authenticated)\n\nKerio Connect 10.0.9 Patch 2 contains a command-injection vulnerability in the WebAdmin JSON-RPC method \nServer.startEncryption. The password parameter is double-quoted and concatenated unescaped into a cryptsetup shell \ncommand that is executed via system() during volume encryption. Because the mail server process runs as root, a \nFullAdmin user can break out of the quotes and execute arbitrary commands as root. Dynamically verified.\n\nImpact: Arbitrary command execution as root on the mail server host. An attacker with admin access can read mail stores \nand credentials, disrupt mail service, and take full control of the server.\n\nAdvisory: https://0day-rubbish.com/blog/kerio-connect-startencryption-cmd-injection-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:16Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/62"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/62"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/kerio-connect-startencryption-cmd-injection-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/62"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Authenticated RCE (command injection) in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI Software)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0125",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/62",
            "automated": true,
            "contentSha256": "b0b733a44be713389f07ff0988bf577c28e3a4030ce1b4c1974d4a7b66b21fe4",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/62",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:56Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:16Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0125"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0124

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Pre-authentication RCE (default credentials + path traversal) in PulseNET Enterprise 6.0.3 (build 6975) (GE Vernova)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in PulseNET Enterprise 6.0.3 (build 6975) (GE Vernova). The research is published and a proof-of-concept is available. Pre-authentication RCE (default credentials + path traversal) (CVSS 9.8, pre-authentication) GE Vernova PulseNET Enterprise 6.0.3 is the network-management software electric utilities use to monitor and manage the industrial wireless networks connecting substations and distribution automation. It ships with factory-default admin/admin credentials with no forced password change, and the resource-management console builds the target file path by raw string concatenation with no normalization. Because Tomcat runs as root with autoDeploy enabled, an attacker can upload a JSP file into a new web application directory and execute arbitrary commands as root. Dynamically verified with uid=0(root). Impact: Full compromise of the power-network management host as root. The attacker can read the host filesystem, execute arbitrary commands, and gain control of the system a utility relies on to manage communications with its grid. Advisory: https://0day-rubbish.com/blog/ge-pulsenet-resource-file-path-traversal-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in PulseNET Enterprise 6.0.3 (build 6975) (GE \nVernova). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (default credentials + path traversal) (CVSS 9.8, pre-authentication)\n\nGE Vernova PulseNET Enterprise 6.0.3 is the network-management software electric utilities use to monitor and manage \nthe industrial wireless networks connecting substations and distribution automation. It ships with factory-default \nadmin/admin credentials with no forced password change, and the resource-management console builds the target file path \nby raw string concatenation with no normalization. Because Tomcat runs as root with autoDeploy enabled, an attacker can \nupload a JSP file into a new web application directory and execute arbitrary commands as root. Dynamically verified \nwith uid=0(root).\n\nImpact: Full compromise of the power-network management host as root. The attacker can read the host filesystem, \nexecute arbitrary commands, and gain control of the system a utility relies on to manage communications with its grid.\n\nAdvisory: https://0day-rubbish.com/blog/ge-pulsenet-resource-file-path-traversal-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:14Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/61"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/61"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/ge-pulsenet-resource-file-path-traversal-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/61"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (default credentials + path traversal) in PulseNET Enterprise 6.0.3 (build 6975) (GE Vernova)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0124",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/61",
            "automated": true,
            "contentSha256": "9f220ea30cccbbd4ef2f593c8bfa113c8f77c77556b539fb712b77c2abe81c54",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/61",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:43Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:14Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0124"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0123

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Pre-authentication RCE (BinaryFormatter deserialization) in Cinegy Cinegize 2026-02-05 installer (Cinegy GmbH)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Cinegy Cinegize 2026-02-05 installer (Cinegy GmbH). The research is published and a proof-of-concept is available. Pre-authentication RCE (BinaryFormatter deserialization) (CVSS 9.8, pre-authentication) Cinegy Cinegize (2026-02-05 installer) registers a Windows service listening on TCP 51140 with a DotNetty pipeline that deserializes .NET BinaryFormatter objects before the authorization handler runs. An unauthenticated remote attacker sends a TypeConfuseDelegate gadget frame; deserialization triggers Process.Start as LocalSystem. No authentication, no license gate, and a default inbound firewall rule make the service reachable in a default install. Dynamically verified. Impact: Full compromise of the broadcast and media-workflow automation host as LocalSystem. The attacker can disrupt broadcast operations, execute arbitrary commands, and access media assets. Advisory: https://0day-rubbish.com/blog/cinegy-cinegize-unauth-binaryformatter-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Cinegy Cinegize 2026-02-05 installer (Cinegy \nGmbH). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (BinaryFormatter deserialization) (CVSS 9.8, pre-authentication)\n\nCinegy Cinegize (2026-02-05 installer) registers a Windows service listening on TCP 51140 with a DotNetty pipeline that \ndeserializes .NET BinaryFormatter objects before the authorization handler runs. An unauthenticated remote attacker \nsends a TypeConfuseDelegate gadget frame; deserialization triggers Process.Start as LocalSystem. No authentication, no \nlicense gate, and a default inbound firewall rule make the service reachable in a default install. Dynamically verified.\n\nImpact: Full compromise of the broadcast and media-workflow automation host as LocalSystem. The attacker can disrupt \nbroadcast operations, execute arbitrary commands, and access media assets.\n\nAdvisory: https://0day-rubbish.com/blog/cinegy-cinegize-unauth-binaryformatter-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/60"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/60"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/cinegy-cinegize-unauth-binaryformatter-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/60"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (BinaryFormatter deserialization) in Cinegy Cinegize 2026-02-05 installer (Cinegy GmbH)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0123",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/60",
            "automated": true,
            "contentSha256": "8990a96469d6a144c8ca7f9fcafbbe13d8a0bec675d51d1a867783b2242c8792",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/60",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:30Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0123"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0122

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Pre-authentication RCE in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity))
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity)). The research is published and a proof-of-concept is available. Pre-authentication RCE (CVSS 9.8, pre-authentication) Wyn Enterprise 9.1.00145.0 exposes an unauthenticated root RCE chain of three vulnerabilities: JWT signature validation is skipped (parse-only ReadToken) with a hardcoded integration client secret, producing an unauthenticated 10-year admin reference token; the import endpoint allows a zip-slip arbitrary file write (a malicious DLL can be dropped into the security-provider folder); and the security-provider loader scans DLLs and calls Activator.CreateInstance on the parameterless constructor, running as root. All three are reachable without credentials in the default configuration. Dynamically verified with root RCE. Impact: Full host compromise as root (the dotnet container process); the attacker can read the host filesystem, execute arbitrary commands, and take full control of the Wyn server. Advisory: https://0day-rubbish.com/blog/wyn-enterprise-unauth-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity)). \nThe research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nWyn Enterprise 9.1.00145.0 exposes an unauthenticated root RCE chain of three vulnerabilities: JWT signature validation \nis skipped (parse-only ReadToken) with a hardcoded integration client secret, producing an unauthenticated 10-year \nadmin reference token; the import endpoint allows a zip-slip arbitrary file write (a malicious DLL can be dropped into \nthe security-provider folder); and the security-provider loader scans DLLs and calls Activator.CreateInstance on the \nparameterless constructor, running as root. All three are reachable without credentials in the default configuration. \nDynamically verified with root RCE.\n\nImpact: Full host compromise as root (the dotnet container process); the attacker can read the host filesystem, execute \narbitrary commands, and take full control of the Wyn server.\n\nAdvisory: https://0day-rubbish.com/blog/wyn-enterprise-unauth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/59"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/59"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/wyn-enterprise-unauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/59"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity))",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0122",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/59",
            "automated": true,
            "contentSha256": "22d821eb4cbc90b4cd35522f655d8d9edeadafe263eeb62960f825ccd189ed0e",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/59",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:17Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0122"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0121

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Pre-authentication RCE (default credentials) in ObjectDB 2.9.5 server mode (ObjectDB Software)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in ObjectDB 2.9.5 server mode (ObjectDB Software). The research is published and a proof-of-concept is available. Pre-authentication RCE (default credentials) (CVSS 9.8, pre-authentication) ObjectDB 2.9.5 server mode (port 6136, proprietary binary protocol) has a critical remote code execution vulnerability: JDOQL query filter evaluation allows arbitrary static-method reflective invocation. Factory default credentials admin/admin grant full privileges with no forced change; the IP check accepts any source IP when the user has no ip attribute. A malicious JDOQL filter such as java.lang.Runtime.getRuntime().exec(cmd) != null is evaluated server-side: QNF.q() loads any class (no class-name allowlist), MCN.l() calls Method.invoke with setAccessible(true), reaching Runtime.exec - the server-side Java process runs as root, yielding uid=0(root) RCE. Dynamically verified. Impact: Full read of the host filesystem and JVM environment as root, arbitrary OS command execution, and full control of the ObjectDB host and database. Advisory: https://0day-rubbish.com/blog/objectdb-jdoql-injection-root-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in ObjectDB 2.9.5 server mode (ObjectDB Software). \nThe research is published and a proof-of-concept is available.\n\nPre-authentication RCE (default credentials) (CVSS 9.8, pre-authentication)\n\nObjectDB 2.9.5 server mode (port 6136, proprietary binary protocol) has a critical remote code execution vulnerability: \nJDOQL query filter evaluation allows arbitrary static-method reflective invocation. Factory default credentials \nadmin/admin grant full privileges with no forced change; the IP check accepts any source IP when the user has no ip \nattribute. A malicious JDOQL filter such as java.lang.Runtime.getRuntime().exec(cmd) != null is evaluated server-side: \nQNF.q() loads any class (no class-name allowlist), MCN.l() calls Method.invoke with setAccessible(true), reaching \nRuntime.exec - the server-side Java process runs as root, yielding uid=0(root) RCE. Dynamically verified.\n\nImpact: Full read of the host filesystem and JVM environment as root, arbitrary OS command execution, and full control \nof the ObjectDB host and database.\n\nAdvisory: https://0day-rubbish.com/blog/objectdb-jdoql-injection-root-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/58"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/58"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/objectdb-jdoql-injection-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/58"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (default credentials) in ObjectDB 2.9.5 server mode (ObjectDB Software)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0121",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/58",
            "automated": true,
            "contentSha256": "7504b3d42652b55eb3bd0b8ba381dce0ecbca0da8a5d07703ccebe0524bf7d33",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/58",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:05Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0121"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0120

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:51
VLAI
Title
Security advisory: Pre-authentication RCE in nanoDLP stable build #10729 (Nano3Dtech)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in nanoDLP stable build #10729 (Nano3Dtech). The research is published and a proof-of-concept is available. Pre-authentication RCE (CVSS 9.8, pre-authentication) nanoDLP exposes an unauthenticated remote code execution vulnerability. The Guest (unauthenticated) endpoint POST /formula evaluates user-supplied JavaScript in an embedded Otto JS sandbox, which exposes a live nanoDLP domain object via nanodlpContext(). The Config object is a cross-request shared live pointer; Config.ShieldUnpause is writable, and Config.Save() persists it to db/machine.json without sanitization. An attacker injects [[Exec <cmd>]] into ShieldUnpause, then the also-unauthenticated GET /printer/unpause triggers the print engine to execute the G-code, reaching os/exec with shell semantics as root. Dynamically verified with uid=0(root). Impact: Full read of the host filesystem and configuration as root, arbitrary OS command execution, and full control of the print server and host. The injected G-code is persisted and re-executes on every unpause. Advisory: https://0day-rubbish.com/blog/nanodlp-unauth-gcode-injection-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in nanoDLP stable build #10729 (Nano3Dtech). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nnanoDLP exposes an unauthenticated remote code execution vulnerability. The Guest (unauthenticated) endpoint POST \n/formula evaluates user-supplied JavaScript in an embedded Otto JS sandbox, which exposes a live nanoDLP domain object \nvia nanodlpContext(). The Config object is a cross-request shared live pointer; Config.ShieldUnpause is writable, and \nConfig.Save() persists it to db/machine.json without sanitization. An attacker injects [[Exec \u003ccmd\u003e]] into \nShieldUnpause, then the also-unauthenticated GET /printer/unpause triggers the print engine to execute the G-code, \nreaching os/exec with shell semantics as root. Dynamically verified with uid=0(root).\n\nImpact: Full read of the host filesystem and configuration as root, arbitrary OS command execution, and full control of \nthe print server and host. The injected G-code is persisted and re-executes on every unpause.\n\nAdvisory: https://0day-rubbish.com/blog/nanodlp-unauth-gcode-injection-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/57"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/57"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/nanodlp-unauth-gcode-injection-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/57"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in nanoDLP stable build #10729 (Nano3Dtech)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0120",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/57",
            "automated": true,
            "contentSha256": "311e7dc120b27dccd2a21cc671849c884ae669888482809cc8e55f1638e05953",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/57",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:51Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0120"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0119

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:50
VLAI
Title
Security advisory: Pre-authentication SYSTEM RCE in MAPS SCADA 4.0.5.5 (Adroit Technologies)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in MAPS SCADA 4.0.5.5 (Adroit Technologies). The research is published and a proof-of-concept is available. Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication) MAPS SCADA 4.0.5.5 exposes an IIS WebService (default port 8878) whose WSDataProvider.asmx endpoints deserialize the caller-supplied byte array before any authentication. Serializer.BinaryDeserialization internally calls new BinaryFormatter().Deserialize(stream) with no SerializationBinder and no TypeFilterLevel. An attacker sends a single unauthenticated HTTP SOAP POST carrying a GZip-compressed BinaryFormatter gadget (TypeConfuseDelegate -> Process.Start), achieving arbitrary command execution as the IIS app pool identity - NT AUTHORITY\SYSTEM in the default deployment. Dynamically verified. Impact: Full compromise of the SCADA host as NT AUTHORITY\SYSTEM; the attacker can read any file, execute arbitrary commands, and take full control of the SCADA environment. Advisory: https://0day-rubbish.com/blog/maps-scada-unauth-binaryformatter-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in MAPS SCADA 4.0.5.5 (Adroit Technologies). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nMAPS SCADA 4.0.5.5 exposes an IIS WebService (default port 8878) whose WSDataProvider.asmx endpoints deserialize the \ncaller-supplied byte array before any authentication. Serializer.BinaryDeserialization internally calls new \nBinaryFormatter().Deserialize(stream) with no SerializationBinder and no TypeFilterLevel. An attacker sends a single \nunauthenticated HTTP SOAP POST carrying a GZip-compressed BinaryFormatter gadget (TypeConfuseDelegate -\u003e \nProcess.Start), achieving arbitrary command execution as the IIS app pool identity - NT AUTHORITY\\SYSTEM in the default \ndeployment. Dynamically verified.\n\nImpact: Full compromise of the SCADA host as NT AUTHORITY\\SYSTEM; the attacker can read any file, execute arbitrary \ncommands, and take full control of the SCADA environment.\n\nAdvisory: https://0day-rubbish.com/blog/maps-scada-unauth-binaryformatter-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:59Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/56"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/56"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/maps-scada-unauth-binaryformatter-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/56"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in MAPS SCADA 4.0.5.5 (Adroit Technologies)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0119",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/56",
            "automated": true,
            "contentSha256": "da970b16449b913dd2e753b4f0f695fcdf14739866217cd694117b71e45d2ad8",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/56",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:59Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0119"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0118

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:50
VLAI
Title
Security advisory: Pre-authentication RCE in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, Inc.)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, Inc.). The research is published and a proof-of-concept is available. Pre-authentication RCE (CVSS 9.8, pre-authentication) Confluent Platform 7.9.1-ce exposes an unauthenticated remote code execution chain in its default configuration. ksqlDB (HTTP 8089), the Kafka broker (9092 PLAINTEXT, no SASL) and Kafka Connect (8083) all accept requests without authentication. An attacker submits a CREATE SINK CONNECTOR statement to ksqlDB using FileStreamSinkConnector with an attacker-controlled file path and StringConverter, then produces arbitrary bytes to the subscribed Kafka topic through the unauthenticated broker. The connector appends each message to the target file; writing a cron line to /etc/cron.d/ yields arbitrary command execution as root when crond runs. Dynamically verified with uid=0(root). Impact: Arbitrary command execution as root (the ksqlDB/Connect process user); the attacker can read or destroy data on the host, persist access, and take full control of the Confluent deployment. No credentials are required. Advisory: https://0day-rubbish.com/blog/ksqldb-unauth-sink-connector-cron-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, \nInc.). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nConfluent Platform 7.9.1-ce exposes an unauthenticated remote code execution chain in its default configuration. ksqlDB \n(HTTP 8089), the Kafka broker (9092 PLAINTEXT, no SASL) and Kafka Connect (8083) all accept requests without \nauthentication. An attacker submits a CREATE SINK CONNECTOR statement to ksqlDB using FileStreamSinkConnector with an \nattacker-controlled file path and StringConverter, then produces arbitrary bytes to the subscribed Kafka topic through \nthe unauthenticated broker. The connector appends each message to the target file; writing a cron line to /etc/cron.d/ \nyields arbitrary command execution as root when crond runs. Dynamically verified with uid=0(root).\n\nImpact: Arbitrary command execution as root (the ksqlDB/Connect process user); the attacker can read or destroy data on \nthe host, persist access, and take full control of the Confluent deployment. No credentials are required.\n\nAdvisory: https://0day-rubbish.com/blog/ksqldb-unauth-sink-connector-cron-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/55"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/55"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/ksqldb-unauth-sink-connector-cron-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/55"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, Inc.)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0118",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/55",
            "automated": true,
            "contentSha256": "e7fed5aea4defd00047e128e708b62970bd2d623d56ed95d2584eebf55081902",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/55",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0118"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0117

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:50
VLAI
Title
Security advisory: Pre-authentication SYSTEM RCE in iMonnit Express 4.0.5.5 (Monnit / iMonnit)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in iMonnit Express 4.0.5.5 (Monnit / iMonnit). The research is published and a proof-of-concept is available. Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication) iMonnit Express 4.0.5.5 is an ASP.NET Core application running as a Windows service with LocalSystem privileges, with no global [Authorize] filter. Three flaws combine into a fully unauthenticated root RCE chain: an auth bypass (an empty security answer list issues a valid admin cookie), a path-traversal file write in the certificate upload endpoint (reachable with the forged cookie), and a plugin loader that calls Assembly.Load + Activator.CreateInstance on the plugin's parameterless constructor BEFORE the IExpressPlugin check - the constructor runs as LocalSystem. Dynamically verified: whoami = nt authority\system. Impact: Full read of the host filesystem and configuration as NT AUTHORITY\SYSTEM, arbitrary OS command execution, and full control of the iMonnit Express host. Advisory: https://0day-rubbish.com/blog/imonnit-express-unauth-plugin-rce PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish -- 0day Rubbish Research Team https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in iMonnit Express 4.0.5.5 (Monnit / iMonnit). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\niMonnit Express 4.0.5.5 is an ASP.NET Core application running as a Windows service with LocalSystem privileges, with \nno global [Authorize] filter. Three flaws combine into a fully unauthenticated root RCE chain: an auth bypass (an empty \nsecurity answer list issues a valid admin cookie), a path-traversal file write in the certificate upload endpoint \n(reachable with the forged cookie), and a plugin loader that calls Assembly.Load + Activator.CreateInstance on the \nplugin\u0027s parameterless constructor BEFORE the IExpressPlugin check - the constructor runs as LocalSystem. Dynamically \nverified: whoami = nt authority\\system.\n\nImpact: Full read of the host filesystem and configuration as NT AUTHORITY\\SYSTEM, arbitrary OS command execution, and \nfull control of the iMonnit Express host.\n\nAdvisory: https://0day-rubbish.com/blog/imonnit-express-unauth-plugin-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/54"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/54"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/imonnit-express-unauth-plugin-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/54"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in iMonnit Express 4.0.5.5 (Monnit / iMonnit)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0117",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/54",
            "automated": true,
            "contentSha256": "62f141d0cd4f591221ed21a7ea4783e9ca3951258d868eace70668e4b363e7aa",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/54",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:13Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0117"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
displaying 41 - 50 publications in total 387