Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Lansweeper 12.2.1.0 (web reports 12.2.1.6) \n(Lansweeper). The research is published and a proof-of-concept is available.\n\nAuthenticated RCE (second-order SQL injection) (CVSS 8.8, authenticated)\n\nLansweeper 12.2.1.0 contains a second-order SQL injection in the LicenseActions console. A SQL Server sub-server name \ncontaining a single quote is stored and later concatenated unescaped into a NOT LIKE clause; the query is executed with \nstacked statements, enabling EXEC xp_cmdshell. The default lansweeperuser database account is SQL Server sysadmin and \nxp_cmdshell is enabled by default, so an authenticated administrator achieves remote code execution. Dynamically \nverified.\n\nImpact: Full compromise of the Lansweeper server. The attacker can execute arbitrary commands, read scanned asset and \ncredential data, and pivot into the managed network.\n\nAdvisory: https://0day-rubbish.com/blog/lansweeper-licenseactions-sqli-xpcmdshell-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:19Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/63"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/63"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/lansweeper-licenseactions-sqli-xpcmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/63"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Authenticated RCE (second-order SQL injection) in Lansweeper 12.2.1.0 (web reports 12.2.1.6) (Lansweeper)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0126",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/63",
            "automated": true,
            "contentSha256": "b79a652e47cb35bc955ae62909cd8888ae1638681369ff80f25aed940287ed33",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/63",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:09Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:19Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0126"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI \nSoftware). The research is published and a proof-of-concept is available.\n\nAuthenticated RCE (command injection) (CVSS 8.8, authenticated)\n\nKerio Connect 10.0.9 Patch 2 contains a command-injection vulnerability in the WebAdmin JSON-RPC method \nServer.startEncryption. The password parameter is double-quoted and concatenated unescaped into a cryptsetup shell \ncommand that is executed via system() during volume encryption. Because the mail server process runs as root, a \nFullAdmin user can break out of the quotes and execute arbitrary commands as root. Dynamically verified.\n\nImpact: Arbitrary command execution as root on the mail server host. An attacker with admin access can read mail stores \nand credentials, disrupt mail service, and take full control of the server.\n\nAdvisory: https://0day-rubbish.com/blog/kerio-connect-startencryption-cmd-injection-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:16Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/62"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/62"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/kerio-connect-startencryption-cmd-injection-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/62"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Authenticated RCE (command injection) in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI Software)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0125",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/62",
            "automated": true,
            "contentSha256": "b0b733a44be713389f07ff0988bf577c28e3a4030ce1b4c1974d4a7b66b21fe4",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/62",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:56Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:16Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0125"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Scrutinizer 19.7.0 (Plixer). The research is \npublished and a proof-of-concept is available.\n\nAuthenticated RCE (SQL injection) (CVSS 8.8, authenticated)\n\nPlixer Scrutinizer 19.7.0 concatenates the HTTP orderBy parameter directly into a SQL ORDER BY clause with no escaping \nin the adminEditLang handler. The default configuration includes the pg_cron extension and a PostgreSQL SUPERUSER \ndatabase role, so an authenticated administrator can inject a side-effect expression that schedules a cron job \nexecuting arbitrary commands as the postgres user. Dynamically verified.\n\nImpact: Arbitrary command execution on the flow-analytics appliance as the postgres user inside the default privileged \ncontainer. The attacker can disrupt monitoring, access network flow data, and take control of the host.\n\nAdvisory: https://0day-rubbish.com/blog/plixer-scrutinizer-orderby-sqli-pgcron-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:26Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/66"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/66"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/plixer-scrutinizer-orderby-sqli-pgcron-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/66"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Authenticated RCE (SQL injection) in Scrutinizer 19.7.0 (Plixer)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0129",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/66",
            "automated": true,
            "contentSha256": "19fee513503623dbb02b93dfc779c6e707ec72663fa43a6037c837f26bd1821c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/66",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:48Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:26Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0129"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 \n(CIRCUTOR S.A.). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nThe native engine PwrStudio.exe runs as the Windows service CircutorPowerStudioScadaServer under NT AUTHORITY\\SYSTEM. \nThe shared fail-open JWT library (see companion advisory) accepts a forged alg=none JWT with role=Admin. Combined with \na path-traversal write of a malicious default.xeve events configuration (containing a shellExecute action) against \nPSSWidgets (port 8105) and an HTTP engine restart against PSSAdministrator (port 8089), an unauthenticated attacker \nforces the engine to reload the configuration and fire XCEventActionShellExecute::Execute, which reaches CreateProcessW \nwith attacker-controlled arguments as SYSTEM. Under a strict default deployment where 8089 is loopback-only with no \nforwarding path, the chain does not close for a pure-remote unauthenticated attacker; once 8089 is reachable (reverse \nproxy, rebind, same-host, or same segment), it is a full unauthenticated remote SYSTEM RCE.\n\nImpact: Arbitrary command execution as NT AUTHORITY\\SYSTEM on the SCADA host; the attacker controls the SCADA engine, \nthe event configuration, and the underlying Windows host.\n\nAdvisory: https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce\n\nVulnerability 2: JWT forgery / authentication bypass (CVSS 8.6, pre-authentication)\n\nEvery .NET Core microservice registers JWT Bearer authentication via a shared extension method configured fail-open: a \ncustom SignatureValidator that always returns a non-null token without validating the signature, \nRequireSignedTokens=false, ValidateIssuerSigningKey=false, ValidateIssuer=false, ValidateAudience=false, and an \nOnAuthenticationFailed handler that silently swallows exceptions. Any attacker-crafted alg=none JWT with any role claim \nis accepted as a valid authenticated identity by every microservice\u0027s AdminSecure/UserSecure policy. No credentials, no \nsigning key, and no user account are required; only network reachability to the target microservice port. This is an \nauthentication-bypass/identity-forgery primitive that compromises the product\u0027s entire authentication trust root and is \nthe auth-bypass primitive that enables the companion shellExecute RCE chain.\n\nImpact: Impersonate any Admin/User role and call any protected endpoint: stop/start the SCADA engine or microservices \n(DoS), push configuration, upload/download/delete files, configure external communication, and manage licenses; no \ncredentials required.\n\nAdvisory: https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/8"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery"
        },
        {
          "url": "https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including JWT forgery / authentication bypass, Pre-authentication SYSTEM RCE in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR S.A.)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0055",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/8",
            "automated": true,
            "contentSha256": "58e108022707975fd14683eff98ee10fc1c059144d9993ff6ca49b14208bced2",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0055"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in atvise SCADA 3.13.0 (atvise GmbH / Bachmann \nVisutec). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nThe main service process atserver runs as root and exposes two independent authentication backends: a WebMI HTTP \nbackend that verifies passwords, and an OPC UA binary protocol backend on port 4840 that does not. The OPC UA \nlogonSessionUser path never calls the password-verification function; it only checks that the \nSYSTEM.SECURITY.USERS.\u003cusername\u003e node exists. Any non-empty password for root yields a superuser session, even under a \nstrong root password. The chain combines this auth bypass with an OPC UA write that overwrites a built-in WebMI \nmethod\u0027s V8 script, an anonymous WebMI session built via a digest bypass, and an anonymous POST that triggers the \ntampered V8 script. The V8 engine runs inside atserver (root), so the injected script inherits root and executes \narbitrary commands. The chain was verified by reading /etc/shadow. The only precondition is that the WEBACCESS module \nis loaded, which is the normal running state of a licensed production deployment.\n\nImpact: Complete host compromise as root; the attacker can read any file, execute arbitrary commands, and alter SCADA \ncontrol logic and node values.\n\nAdvisory: https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce\n\nVulnerability 2: Default-credential RCE (CVSS 8.8, authenticated)\n\nThe WebHMI service (Boost.Beast HTTP on ports 80/443) uses a custom WebMI authentication scheme. The built-in root user \nships with a factory default empty password, and the handleLogin handler has a \u0027password not set\u0027 branch that grants \nthe superuser session for an existing user without verifying the supplied passwords while that default state is in \nplace. The chain combines the default-credential login (login(root, any value) yields the root superuser session), a V8 \nScriptCode injection via AddNode, a ReportRunConfiguration trigger that loads the attacker script into the embedded V8 \nengine, and a ChildProcess.execAsync payload. The V8 engine runs inside atserver (root), so the injected script \ninherits root. Setting a strong root password via changepassword closes the login bypass. The only precondition is that \nthe WEBACCESS module is loaded.\n\nImpact: Complete host compromise as root; the attacker can read any file, execute arbitrary commands, and alter SCADA \ncontrol logic and node values.\n\nAdvisory: https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/5"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0053",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/5",
            "automated": true,
            "contentSha256": "5f35e4b7a988f79d9ca7b4948960b18fa7e165d1082fce2c8b33313be9737c3c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0053"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 3 vulnerabilities in CatDV Server 10.7.8 (Square Box Systems). The \nresearch is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nA three-defect chain turns any deployment into an unauthenticated root RCE. An RMI connect(null) path makes the server \nmint a ClientID using its own internal client.regcode system property (zero attacker credentials). A saveSettings \nmethod gated only by that ClientID with no admin check writes an attacker-controlled catdv.aaftoolPath into the JVM \nsystem properties. An AAFExportHandler ProcessUtils.exec sink runs that path as root on every AAF export request. The \nfactory-default empty admin password closes the chain by supplying the admin session needed to reach the AAF trigger. \nDynamic verification produced uid=0(root).\n\nImpact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); the attacker holds no \nproduct license key and no user credentials.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce\n\nVulnerability 2: Hardcoded credentials (CVSS 9.8, pre-authentication)\n\nThe factory-default database seed creates the built-in admin user with password=0 and passwordHash=NULL. The password \nverification routine skips the PBKDF2 path when passwordHash is null and falls back to a legacy simpleMD5Hash path, \nwhere simpleMD5Hash(\u0027\u0027) returns 0 and 0 == 0 evaluates to true. Anyone who can reach the CatDV web login endpoint can \nauthenticate as the administrator using admin with an empty password, as long as the factory default has not been \nchanged. This grants full administrator control of the MAM server and is the credential prerequisite for the \nauthenticated root RCE chain.\n\nImpact: Full administrator takeover of the CatDV server using the well-known built-in admin username with an empty \npassword; the admin session can read or alter any catalog data, server configuration, or user account.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password\n\nVulnerability 3: Authenticated RCE (property injection) (CVSS 7.6, authenticated)\n\nAn authenticated administrator can turn any running deployment into a root RCE by injecting the catdv.aaftoolPath JVM \nsystem property to point at an attacker-controlled script and then triggering an AAF export. The type-23 \n\u0027server-config\u0027 setting is applied verbatim as System.setProperty(key, value) pairs with no property whitelist, and \nAAFExportHandler runs that property via ProcessUtils.exec as root on every AAF export request. The injected property is \nauto-applied on the next request (1s throttle), so no server restart is needed. Dynamic verification produced \nuid=0(root).\n\nImpact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); an admin session on the \nweb API is required.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/6"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Authenticated RCE (property injection), Hardcoded credentials, Pre-authentication root RCE in CatDV Server 10.7.8 (Square Box Systems)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0054",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/6",
            "automated": true,
            "contentSha256": "fcc939a21fe54550bf830f81863d367df0c4c732c3286455b68ac1bbeac4087b",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0054"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "LOMOSITS.Daniel via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Reference: https://seclists.org/fulldisclosure/2026/Aug/5\n\nI tested both vulnerabilities against a clean installation of atvise SCADA 3.13.0. Results differ between the two \nfindings.\n\n---\n\nVulnerability 1 (OPC UA pre-authentication root RCE, CVSS 9.8) - NOT REPRODUCIBLE\n\nThe ActivateSession step - identified as the authentication bypass entry point - returns BadUserAccessDenied:\n\n    WebMI login(root, bogus) -\u003e 200 {\"error\":-1,\"errorstring\":\"Invalid Session or Digest\"}\n        [+] root has a strong password (bogus login rejected)\n    [Step 1] OPC UA 4840 ActivateSession(root, bogus) -- authentication bypass\n    ServiceFault (BadUserAccessDenied, diagnostics: DiagnosticInfo(\n      SymbolicId=None, NamespaceURI=None, Locale=None,\n      LocalizedText=None, AdditionalInfo=None,\n      InnerStatusCode=None, InnerDiagnosticInfo=None))\n    from server received in response to ActivateSessionRequest\n\nThe OPC UA backend rejects the bogus password and does not yield a superuser session, contrary to the advisory\u0027s claim \nthat logonSessionUser never calls the password-verification function.\n\nNote for anyone attempting independent reproduction: the advisory\u0027s license note discloses that the research was \nconducted against a binary-patched installation (patch 5: isLicensed() forced to 1; patch 6: session-count bypass). \nWhether OPC UA authentication behaviour differs between the patched binary and an unmodified licensed installation \nremains the open question. If the 0day Rubbish Research Team can clarify whether the ActivateSession step was verified \nagainst the original unpatched binary, that would help resolve the discrepancy.\n\n---\n\nVulnerability 2 (WebMI default-credential RCE, CVSS 8.8) - REPRODUCIBLE\n\nConfirmed. login(root, \u003cany value\u003e) returns {\"username\":\"root\"} on a factory-default installation. The handleLogin \n\u0027password not set\u0027 branch behaves exactly as described. Setting a strong root password via changepassword closes the \nbypass.\n\nMit freundlichen Gr\u00fc\u00dfen\nWith kind regards\n\nIng. Daniel Lomosits MSc MBA BSc\nProduct Manager\n\nP +43 (0)2682 / 75799-2829 M +43 (0) 676 / 702 80 87 | daniel.lomosits () bachmann info\u003cmailto:daniel.lomosits () \nbachmann info\u003e | www.bachmann-visutec.com\u003chttp://www.bachmann-visutec.com/\u003e\n\n[cid:image001.png@01DD2E3D.5EAA1330]\u003chttps://atvise.com/\u003e\n\nRegistered Office:\nBachmann Visutec GmbH, Kasernenstra\u00dfe 29, 7000 Eisenstadt, Austria\nFN 274018v Commercial Register Eisenstadt | ATU 62240738\nCorporate Headquarters:\nBachmann electronic GmbH, Kreuz\u00e4ckerweg 33, 6800 Feldkirch, Austria\nFN 75348g Commercial Register Feldkirch | ATU 36410905\n\nDokumente mit rechtsverbindlichem Inhalt sind nur mit Originalunterschrift wirksam.\nDocuments with legally binding subject matter are valid only with original hand-written signature.\n\nFollow Bachmann on  Facebook\u003chttps://www.facebook.com/Bachmann.electronic/\u003e |  \nLinkedIn\u003chttps://www.linkedin.com/company/bachmann-electronic-gmbh\u003e |  Twitter\u003chttps://twitter.com/bachmann_corp\u003e |  \nXing\u003chttps://www.xing.com/companies/bachmannelectronicgmbh\u003e |  \nYouTube\u003chttps://www.youtube.com/channel/UCE5LllKmEA5ZtBnsIpvVqxg\u003e\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:49:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/39"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/39"
        },
        {
          "url": "http://www.bachmann-visutec.com/"
        },
        {
          "url": "https://atvise.com/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/2026/Aug/5"
        },
        {
          "url": "https://twitter.com/bachmann_corp"
        },
        {
          "url": "https://www.facebook.com/Bachmann.electronic/"
        },
        {
          "url": "https://www.linkedin.com/company/bachmann-electronic-gmbh"
        },
        {
          "url": "https://www.xing.com/companies/bachmannelectronicgmbh"
        },
        {
          "url": "https://www.youtube.com/channel/UCE5LllKmEA5ZtBnsIpvVqxg"
        },
        {
          "url": "mailto:daniel.lomosits"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/39"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0031",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/39",
            "automated": true,
            "contentSha256": "b464e33cfb97e6aeb144887f62b793310a01e8e379d3f8eb9852a05dd2a1e3d3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/39",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T11:42:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:49:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0031"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in Xeams 10.3 build 6449 (Synametrics \nTechnologies). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nA framework-level debug write primitive in the rules engine reads an attacker-controlled MIME header, \nX-SM_SAVE_BODY_4DEBUGGING, as an absolute file path and the message body as the file content, writing to any path on \nthe host with no validation, no allowlist, and no authentication gate. The SMTP service accepts unauthenticated \ndelivery by default (reqAuthForLocal=false is the global default). When Xeams runs as root, an attacker writes a cron \njob into /etc/cron.d/, which crond executes as root every minute, yielding a complete unauthenticated root RCE. The \nentire chain depends only on SMTP, requires no HTTP and no credentials, and was dynamically verified on both port 25 \nand port 587 producing uid=0(root).\n\nImpact: Arbitrary root command execution on the mail server host, full root read of the Xeams mail repository (all .eml \nenvelope/subject/body), and complete control of the Xeams process; no credentials required.\n\nAdvisory: https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce\n\nVulnerability 2: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nThe built-in SQLRunner.jsp administrative page is directly reachable without authentication: web.xml declares no \nsecurity-constraint for JSPs, the SynaFilter maps only /FrontController/*, and NewPageHeader.jsp does not enforce \nauthentication. Directly requesting SQLRunner.jsp bypasses the FrontController dispatch, the SynaFilter, and the \noperation-level authorization. The operation=1 branch performs no auth check and connects to the embedded Derby \ndatabase using attacker-supplied credentials; Xeams hardcodes the Derby database-owner credentials system/manager, so \nan attacker reuses them. With the JDBC connection stored in the HTTP session, operation=2 issues arbitrary SQL, and \ncalling the Derby procedure SYSCS_UTIL.SYSCS_EXPORT_QUERY writes an attacker-controlled JSP webshell into the Tomcat \nwebapps/ROOT docBase. A subsequent GET triggers Jasper on-demand compilation and execution, yielding arbitrary command \nexecution at the Xeams process privilege (root in the default deployment). The chain requires only HTTP access to the \nXeams web port (default 5272/TCP), no valid login, no CSRF token, and no prior session. The RCE was dynamically \nverified end-to-end producing uid=0(root).\n\nImpact: Arbitrary command execution on the mail server host at the Xeams process privilege (root in the default \ndeployment), full read of the Xeams mail repository and the host filesystem, and complete control of the Xeams process \nand embedded Derby database.\n\nAdvisory: https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:23Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/13"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Pre-authentication root RCE in Xeams 10.3 build 6449 (Synametrics Technologies)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0060",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/13",
            "automated": true,
            "contentSha256": "0677fda4e29c7284466913132fa5d7f43fce586521bbff2ddab08fe54750a146",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:23Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0060"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}