Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "15 vulnerabilities",
          "vendor": "Batch",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nFROM: disclosure () 0day-rubbish com\nSUBJECT: [FD] batch-2: 15 vulnerabilities incl. multiple pre-auth RCE across 10 enterprise/SCADA products - full \nanalyses + reproducible exploits\n----BODY----\n0day Rubbish Research Team is publishing its second batch of AI-assisted\nvulnerability research: 15 vulnerabilities across 10 enterprise, SCADA, and\nindustrial software products. All findings are publicly disclosed\n(synchronous, no embargo); affected vendors were notified in parallel. Each\nentry below links to a full technical analysis with a reproducible\nproof-of-concept. PoC repository: https://github.com/Exploit-Garbage/0day-Rubbish\n\n1. AOMEI Cyber Backup v2.3.0 (AOMEI)\n   - Pre-authentication RCE (CVSS 9.8): unauthenticated root RCE via the\n     unauthenticated internal Thrift ports (9074/9078) and a NAS-mount command\n     injection (system() with unescaped username/password). Runs as root in a\n     Docker container; no credentials or user interaction required.\n     Advisory: https://0day-rubbish.com/blog/aomei-cyber-backup-thrift-nas-mount-rce\n\n2. Apache Struts 2 v2.6.11.0\n   - Pre-authentication RCE: OGNL injection via the RESTful mapper request path,\n     allowing remote code execution without authentication.\n     Advisory: https://0day-rubbish.com/blog/apache-struts2-restful-mapper-ognl-rce\n\n3. atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)\n   - Pre-authentication root RCE (CVSS 9.8): the OPC UA logonSessionUser path\n     never verifies the password; any non-empty password for root yields a\n     superuser session, combined with V8 script injection via an OPC UA write\n     and an anonymous WebMI trigger. Verified by reading /etc/shadow.\n     Advisory: https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce\n   - Default-credential RCE (CVSS 8.8): factory-default empty root password plus\n     a \u0027password not set\u0027 branch that grants the superuser session; V8 injection\n     via AddNode and a ReportRunConfiguration trigger.\n     Advisory: https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce\n\n4. CatDV Server 10.7.8 (Square Box Systems)\n   - Authenticated RCE: aaftoolPath command injection executing as root.\n     Advisory: https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce\n   - Hardcoded credentials: admin factory-default empty password.\n     Advisory: https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password\n   - Pre-authentication RCE: unauthenticated RMI path leading to root RCE.\n     Advisory: https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce\n\n5. CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR)\n   - Authentication bypass: a fail-open shared JWT library accepting alg=none\n     tokens, enabling identity forgery.\n     Advisory: https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery\n   - Pre-authentication SYSTEM RCE: JWT forgery combined with a shellExecute\n     event action yielding SYSTEM-level code execution.\n     Advisory: https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce\n\n6. Stimulsoft Server 2026.3.1 (Stimulsoft)\n   - Pre-authentication SYSTEM RCE: unauthenticated report-script injection.\n     Advisory: https://0day-rubbish.com/blog/stimulsoft-server-unauth-report-script-rce\n\n7. Plastic SCM (Unity Technologies)\n   - Pre-authentication RCE: unauthenticated RCE on port 8087.\n     Advisory: https://0day-rubbish.com/blog/plastic-scm-unauth-8087-rce\n\n8. Vicon Valerus / ViconNet Gateway (Vicon)\n   - Pre-authentication SYSTEM RCE: unauthenticated command injection.\n     Advisory: https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce\n\n9. vMix 29 v29.0.0.48 (vMix)\n   - Pre-authentication RCE: VBScript blocklist bypass.\n     Advisory: https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce\n\n10. Xeams 10.3 build 6449 (Synametrics)\n    - Pre-authentication RCE: SMTP saveBody cron-job injection.\n      Advisory: https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce\n    - Pre-authentication RCE: unauthenticated SQL-runner Derby JSP injection.\n      Advisory: https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce\n\nProof-of-concept scripts and full technical analyses are available at the\nadvisory URLs above and at https://github.com/Exploit-Garbage/0day-Rubbish\n\nDisclosure stance: synchronous (no embargo). Vendors were notified in parallel\nwith publication. We are open to coordination with vendors, CISA, or other\ncoordinators who wish to publish advisories.\n\n--\n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:26Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/14"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/14"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/aomei-cyber-backup-thrift-nas-mount-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/apache-struts2-restful-mapper-ognl-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery"
        },
        {
          "url": "https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/plastic-scm-unauth-8087-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/stimulsoft-server-unauth-report-script-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/14"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "batch-2: 15 vulnerabilities incl. multiple pre-auth RCE across 10 enterprise/SCADA products - full analyses + reproducible exploits",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0159",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/14",
            "automated": true,
            "contentSha256": "8ace0415c905e651b1302c3b00c9dbf06c691764bb93867092aa4486e62cf81e",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/14",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-05T09:27:50Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:23Z",
    "dateUpdated": "2026-09-11T11:37:26Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0159"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in Xeams 10.3 build 6449 (Synametrics \nTechnologies). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nA framework-level debug write primitive in the rules engine reads an attacker-controlled MIME header, \nX-SM_SAVE_BODY_4DEBUGGING, as an absolute file path and the message body as the file content, writing to any path on \nthe host with no validation, no allowlist, and no authentication gate. The SMTP service accepts unauthenticated \ndelivery by default (reqAuthForLocal=false is the global default). When Xeams runs as root, an attacker writes a cron \njob into /etc/cron.d/, which crond executes as root every minute, yielding a complete unauthenticated root RCE. The \nentire chain depends only on SMTP, requires no HTTP and no credentials, and was dynamically verified on both port 25 \nand port 587 producing uid=0(root).\n\nImpact: Arbitrary root command execution on the mail server host, full root read of the Xeams mail repository (all .eml \nenvelope/subject/body), and complete control of the Xeams process; no credentials required.\n\nAdvisory: https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce\n\nVulnerability 2: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nThe built-in SQLRunner.jsp administrative page is directly reachable without authentication: web.xml declares no \nsecurity-constraint for JSPs, the SynaFilter maps only /FrontController/*, and NewPageHeader.jsp does not enforce \nauthentication. Directly requesting SQLRunner.jsp bypasses the FrontController dispatch, the SynaFilter, and the \noperation-level authorization. The operation=1 branch performs no auth check and connects to the embedded Derby \ndatabase using attacker-supplied credentials; Xeams hardcodes the Derby database-owner credentials system/manager, so \nan attacker reuses them. With the JDBC connection stored in the HTTP session, operation=2 issues arbitrary SQL, and \ncalling the Derby procedure SYSCS_UTIL.SYSCS_EXPORT_QUERY writes an attacker-controlled JSP webshell into the Tomcat \nwebapps/ROOT docBase. A subsequent GET triggers Jasper on-demand compilation and execution, yielding arbitrary command \nexecution at the Xeams process privilege (root in the default deployment). The chain requires only HTTP access to the \nXeams web port (default 5272/TCP), no valid login, no CSRF token, and no prior session. The RCE was dynamically \nverified end-to-end producing uid=0(root).\n\nImpact: Arbitrary command execution on the mail server host at the Xeams process privilege (root in the default \ndeployment), full read of the Xeams mail repository and the host filesystem, and complete control of the Xeams process \nand embedded Derby database.\n\nAdvisory: https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:23Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/13"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Pre-authentication root RCE in Xeams 10.3 build 6449 (Synametrics Technologies)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0060",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/13",
            "automated": true,
            "contentSha256": "0677fda4e29c7284466913132fa5d7f43fce586521bbff2ddab08fe54750a146",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:23Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0060"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nvMix 29 ships a Windows-native .NET Framework application with a built-in Web Controller HTTP server on port 8088. The \nHTTP API endpoint GET /api/?Function=ScriptStartDynamic\u0026Value=\u003cVB.NET source\u003e takes the Value parameter as VB.NET \nsource code, compiles and executes it via VBScriptProvider.Compile. vMix attempts to sandbox user-supplied scripts with \na 6-item substring blocklist, but the compilation template injects Imports System.Diagnostics into the generated source \nbefore the user\u0027s code, so an attacker can call Process.Start directly without writing the blocked substring. Combined \nwith the Web Controller\u0027s default blank password (which the official documentation states means no login will be \nrequired regardless of the access settings), the entire /api route is reachable without authentication, yielding \nunauthenticated RCE as the user running vMix64.exe (commonly administrator). Pre-research public CVE count for vMix: 0.\n\nImpact: Arbitrary OS command execution as the vMix64.exe run identity (commonly administrator), plus arbitrary file \nread/write via the same blocklist bypass; no credentials required.\n\nAdvisory: https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/12"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0059",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/12",
            "automated": true,
            "contentSha256": "1df256062c2f41c79c2944d415b239febfede190eab238ad05d63e79486a530d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0059"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon \nIndustries). The research is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nVicon Valerus ViconNet Gateway ships an ASP.NET Web API (OWIN self-host, VII.NVR.Host.exe Windows service) bound to \n/NVR/api/v1 on ports 8084/8444. The endpoint POST /NVR/api/v1/upgrades/multiformat-file-Execute/start receives a \n[FromBody] string cmd, concatenates it directly to cmd.exe /c, and invokes Process.Start. None of the 8 OWIN \nmiddlewares perform authentication, UpgradesController is not annotated with [Authorize], and SetupExecuteCommand \nbypasses the UpgradeAuthorizationFlag gate that protects the sibling Upgrade() method. The service runs as LocalSystem, \nso an unauthenticated attacker with network access to the Web API port immediately obtains nt authority\\system remote \ncode execution.\n\nImpact: Full host compromise as nt authority\\system with no credentials required; the attacker can access all recorded \nvideo, camera credentials, and VMS configuration, alter video surveillance state, and tamper with or destroy evidence.\n\nAdvisory: https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:18Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/11"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon Industries)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0058",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/11",
            "automated": true,
            "contentSha256": "4bca9118108632e68858fe19a14bea30d3ae2f8f7886c0c397caf138b0225f2a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:18Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0058"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Plastic SCM (Unity Version Control On-Prem) \n11.0.16.10303 (Unity Technologies). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nPlastic SCM ships a self-developed binary version-control protocol on port 8087, reachable by default on 0.0.0.0. Under \nthe default NameWorkingMode, the server validates only that a client-declared username maps to a local OS account and \nnever checks a password; LocalGroupSEIDProvider.CheckPassword is an empty no-op. Combined with a default EVERYBODY ACL \nthat grants ALL_PERMISSIONS (including mktrigger) to any name-only-authenticated user, an unauthenticated attacker can \ndeclare an administrative username (leaked unauthenticated via GetRepositoryServerInfo), create a server-side trigger \nwhose Path is fully attacker-controlled, and trigger it with a repository operation. TriggerProcess.ExecuteTrigger \nfeeds the Path straight into Process.Start as the FileName with no sandbox, path allowlist, or signature check, \nyielding RCE as the plasticd service account (Linux: plasticscm uid=217; Windows: local Administrator). The only \nnon-network prerequisite is one local OS username, which the protocol itself leaks.\n\nImpact: Full compromise of the version-control server and all repositories, and arbitrary command execution as the \nplasticd service account; the attacker can read source code and repository metadata, create triggers, alter \nrepositories, and persist access.\n\nAdvisory: https://0day-rubbish.com/blog/plastic-scm-unauth-8087-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:16Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/10"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/10"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/plastic-scm-unauth-8087-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/10"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Plastic SCM (Unity Version Control On-Prem) 11.0.16.10303 (Unity Technologies)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0057",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/10",
            "automated": true,
            "contentSha256": "d8eb1511379fda3c83f3f27587a57b37c7909e304d0ec7cd0c86743d790d8c32",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/10",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:36:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:16Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0057"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Stimulsoft Server 2026.3.1 (Stimulsoft). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nA default-configuration defect chain combines into a complete unauthenticated RCE. The /1/signup endpoint is open by \ndefault with email activation disabled, so an anonymous attacker registers and immediately receives a Supervisor \naccount. The Supervisor uploads a .mrt report template containing an embedded C# script. PUT \n/1/reporttemplates/\u003cid\u003e/run triggers the report-script engine, which compiles the script with CSharpCodeProvider in \nfull trust (no AppDomain isolation, no CAS sandbox, no class allowlist) and instantiates the report class, executing \nthe attacker-controlled constructor. The report task runs in the backend service process Stimulsoft.Server.Agent.exe as \nNT AUTHORITY\\SYSTEM. No credentials, no SMTP, no administrator action, and no non-default configuration are required.\n\nImpact: Full system takeover; the report task executes in the backend service process running as NT AUTHORITY\\SYSTEM, \ngiving arbitrary code execution with the highest Windows privilege.\n\nAdvisory: https://0day-rubbish.com/blog/stimulsoft-server-unauth-report-script-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:14Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/9"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/stimulsoft-server-unauth-report-script-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in Stimulsoft Server 2026.3.1 (Stimulsoft)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0056",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/9",
            "automated": true,
            "contentSha256": "e93aa4f24d03c1931d3cd8b6dd3af1323819c4d983936a8ff51957fff654f1c7",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:36:18Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:14Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0056"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 \n(CIRCUTOR S.A.). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nThe native engine PwrStudio.exe runs as the Windows service CircutorPowerStudioScadaServer under NT AUTHORITY\\SYSTEM. \nThe shared fail-open JWT library (see companion advisory) accepts a forged alg=none JWT with role=Admin. Combined with \na path-traversal write of a malicious default.xeve events configuration (containing a shellExecute action) against \nPSSWidgets (port 8105) and an HTTP engine restart against PSSAdministrator (port 8089), an unauthenticated attacker \nforces the engine to reload the configuration and fire XCEventActionShellExecute::Execute, which reaches CreateProcessW \nwith attacker-controlled arguments as SYSTEM. Under a strict default deployment where 8089 is loopback-only with no \nforwarding path, the chain does not close for a pure-remote unauthenticated attacker; once 8089 is reachable (reverse \nproxy, rebind, same-host, or same segment), it is a full unauthenticated remote SYSTEM RCE.\n\nImpact: Arbitrary command execution as NT AUTHORITY\\SYSTEM on the SCADA host; the attacker controls the SCADA engine, \nthe event configuration, and the underlying Windows host.\n\nAdvisory: https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce\n\nVulnerability 2: JWT forgery / authentication bypass (CVSS 8.6, pre-authentication)\n\nEvery .NET Core microservice registers JWT Bearer authentication via a shared extension method configured fail-open: a \ncustom SignatureValidator that always returns a non-null token without validating the signature, \nRequireSignedTokens=false, ValidateIssuerSigningKey=false, ValidateIssuer=false, ValidateAudience=false, and an \nOnAuthenticationFailed handler that silently swallows exceptions. Any attacker-crafted alg=none JWT with any role claim \nis accepted as a valid authenticated identity by every microservice\u0027s AdminSecure/UserSecure policy. No credentials, no \nsigning key, and no user account are required; only network reachability to the target microservice port. This is an \nauthentication-bypass/identity-forgery primitive that compromises the product\u0027s entire authentication trust root and is \nthe auth-bypass primitive that enables the companion shellExecute RCE chain.\n\nImpact: Impersonate any Admin/User role and call any protected endpoint: stop/start the SCADA engine or microservices \n(DoS), push configuration, upload/download/delete files, configure external communication, and manage licenses; no \ncredentials required.\n\nAdvisory: https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/8"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery"
        },
        {
          "url": "https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including JWT forgery / authentication bypass, Pre-authentication SYSTEM RCE in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR S.A.)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0055",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/8",
            "automated": true,
            "contentSha256": "58e108022707975fd14683eff98ee10fc1c059144d9993ff6ca49b14208bced2",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0055"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 3 vulnerabilities in CatDV Server 10.7.8 (Square Box Systems). The \nresearch is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nA three-defect chain turns any deployment into an unauthenticated root RCE. An RMI connect(null) path makes the server \nmint a ClientID using its own internal client.regcode system property (zero attacker credentials). A saveSettings \nmethod gated only by that ClientID with no admin check writes an attacker-controlled catdv.aaftoolPath into the JVM \nsystem properties. An AAFExportHandler ProcessUtils.exec sink runs that path as root on every AAF export request. The \nfactory-default empty admin password closes the chain by supplying the admin session needed to reach the AAF trigger. \nDynamic verification produced uid=0(root).\n\nImpact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); the attacker holds no \nproduct license key and no user credentials.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce\n\nVulnerability 2: Hardcoded credentials (CVSS 9.8, pre-authentication)\n\nThe factory-default database seed creates the built-in admin user with password=0 and passwordHash=NULL. The password \nverification routine skips the PBKDF2 path when passwordHash is null and falls back to a legacy simpleMD5Hash path, \nwhere simpleMD5Hash(\u0027\u0027) returns 0 and 0 == 0 evaluates to true. Anyone who can reach the CatDV web login endpoint can \nauthenticate as the administrator using admin with an empty password, as long as the factory default has not been \nchanged. This grants full administrator control of the MAM server and is the credential prerequisite for the \nauthenticated root RCE chain.\n\nImpact: Full administrator takeover of the CatDV server using the well-known built-in admin username with an empty \npassword; the admin session can read or alter any catalog data, server configuration, or user account.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password\n\nVulnerability 3: Authenticated RCE (property injection) (CVSS 7.6, authenticated)\n\nAn authenticated administrator can turn any running deployment into a root RCE by injecting the catdv.aaftoolPath JVM \nsystem property to point at an attacker-controlled script and then triggering an AAF export. The type-23 \n\u0027server-config\u0027 setting is applied verbatim as System.setProperty(key, value) pairs with no property whitelist, and \nAAFExportHandler runs that property via ProcessUtils.exec as root on every AAF export request. The injected property is \nauto-applied on the next request (1s throttle), so no server restart is needed. Dynamic verification produced \nuid=0(root).\n\nImpact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); an admin session on the \nweb API is required.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/6"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Authenticated RCE (property injection), Hardcoded credentials, Pre-authentication root RCE in CatDV Server 10.7.8 (Square Box Systems)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0054",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/6",
            "automated": true,
            "contentSha256": "fcc939a21fe54550bf830f81863d367df0c4c732c3286455b68ac1bbeac4087b",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0054"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in atvise SCADA 3.13.0 (atvise GmbH / Bachmann \nVisutec). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nThe main service process atserver runs as root and exposes two independent authentication backends: a WebMI HTTP \nbackend that verifies passwords, and an OPC UA binary protocol backend on port 4840 that does not. The OPC UA \nlogonSessionUser path never calls the password-verification function; it only checks that the \nSYSTEM.SECURITY.USERS.\u003cusername\u003e node exists. Any non-empty password for root yields a superuser session, even under a \nstrong root password. The chain combines this auth bypass with an OPC UA write that overwrites a built-in WebMI \nmethod\u0027s V8 script, an anonymous WebMI session built via a digest bypass, and an anonymous POST that triggers the \ntampered V8 script. The V8 engine runs inside atserver (root), so the injected script inherits root and executes \narbitrary commands. The chain was verified by reading /etc/shadow. The only precondition is that the WEBACCESS module \nis loaded, which is the normal running state of a licensed production deployment.\n\nImpact: Complete host compromise as root; the attacker can read any file, execute arbitrary commands, and alter SCADA \ncontrol logic and node values.\n\nAdvisory: https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce\n\nVulnerability 2: Default-credential RCE (CVSS 8.8, authenticated)\n\nThe WebHMI service (Boost.Beast HTTP on ports 80/443) uses a custom WebMI authentication scheme. The built-in root user \nships with a factory default empty password, and the handleLogin handler has a \u0027password not set\u0027 branch that grants \nthe superuser session for an existing user without verifying the supplied passwords while that default state is in \nplace. The chain combines the default-credential login (login(root, any value) yields the root superuser session), a V8 \nScriptCode injection via AddNode, a ReportRunConfiguration trigger that loads the attacker script into the embedded V8 \nengine, and a ChildProcess.execAsync payload. The V8 engine runs inside atserver (root), so the injected script \ninherits root. Setting a strong root password via changepassword closes the login bypass. The only precondition is that \nthe WEBACCESS module is loaded.\n\nImpact: Complete host compromise as root; the attacker can read any file, execute arbitrary commands, and alter SCADA \ncontrol logic and node values.\n\nAdvisory: https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/5"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0053",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/5",
            "automated": true,
            "contentSha256": "5f35e4b7a988f79d9ca7b4948960b18fa7e165d1082fce2c8b33313be9737c3c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0053"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Apache Struts 2 2.6.11.0 (Apache Software \nFoundation). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nApache Struts 2.6.11.0 is vulnerable to unauthenticated remote code execution under a documented REST mapper \nconfiguration combined with wildcard dynamic dispatch. RestfulActionMapper.getMapping() extracts the action name from \nthe request URI without calling cleanupActionName, the character-set gate that DefaultActionMapper adopted after \nS2-057; that fix was never synchronized to the REST mapper. When an application uses struts.mapper.class=restful with a \nwildcard action and a result containing {1} substitution, attacker-controlled OGNL metacharacters flow through the \nwildcard capture into TextParseUtil.translateVariables, bypassing AcceptedPatternsChecker. A novel \njava.beans.Expression/Statement reflection primitive then defeats the SecurityMemberAccess sandbox and reaches \nRuntime.exec. The chain was verified with uid=0(root) on a Tomcat 9 / OGNL 3.3.5 deployment. The only precondition is \nan opt-in but documented configuration subset (REST mapper plus wildcard dynamic dispatch).\n\nImpact: Arbitrary operating system command execution as the JVM process user; on a root-run deployment, full host \ncompromise. No credentials are required.\n\nAdvisory: https://0day-rubbish.com/blog/apache-struts2-restful-mapper-ognl-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:03Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/4"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/apache-struts2-restful-mapper-ognl-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Apache Struts 2 2.6.11.0 (Apache Software Foundation)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0052",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/4",
            "automated": true,
            "contentSha256": "fee326014012576665558b465357a6f742a6c51511c5aadf16abb7a461350217",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:34:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:03Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0052"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}