Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Vulnerability in",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "duykham"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Full Disclosure,\n\nI would like to disclose a security vulnerability identified in a\nsmartphone application: *Koller Secret: Real Hidden App*.\n\nThis report is shared in the interest of responsible disclosure and\nimproving overall security awareness.\n\n---\n\n*Summary*\n- Application: Koller Secret: Real Hidden App\n- Package / Bundle ID: com.koller.secret.hidemyphoto\n- Platform: Android\n- Affected Version(s): v.1.0.27 and below\n- Vulnerability Type: Authentication Bypass\n- Severity: High\n- CVE: Pending\n\n---\n\n*Background*\nKoller Secret claims to be the \"first truly hidden app\" that has \"no\nvisible icon nor launcher\" and *can be accessed only by entering an Android\nsecret code* from the user\u0027s dial pad.\n\n---\n\n*Description*\nThe application contains a vulnerability that allows an attacker to *bypass\ntheir secret code mechanism* to access the app\u0027s main UI.\n\nThe root cause appears to be improper access control on an exported Android\ncomponent. The MainActivity is explicitly declared as\n`android:exported=\"true\"` in the Android manifest, making it accessible to\nexternal applications and enabling unauthorized activity invocation.\n\n---\n\n*Technical Details*\n- Relevant components:\n   - MainActivity / Android Manifest\n- Security mechanism affected:\n   - Access control\n\n*Observed behavior:*\nIt was observed that the application\u0027s MainActivity can be launched\nexternally via ADB by explicitly invoking it with the expected intent\naction (ACTION_LAUNCH). When started in this manner, the application\nbypasses the intended secret code verification mechanism and proceeds\ndirectly to the protected interface.\n\n*Expected behavior:*\nThe application should reject any attempts to launch the protected main\ninterface from external sources, including ADB or other applications.\nAccess to the protected interface should only be granted through the\nofficial application flow, which requires successful secret code entry via\nthe dial pad. All other invocation attempts should be denied.\n\n---\n\n*Proof of Concept (PoC)*\n1. Install \"Koller Secret: Real Hidden App\" version 1.0.27 (or earlier) to\nan Android smartphone.\n2. Connect the smartphone to a desktop machine (e.g., via a USB cable) that\nsupports Android Debug Bridge (ADB).\n3. Launch a command line terminal (or Command Prompt in Windows OS)\n4. Run the command:\n\nadb shell am start -n com.koller.secret.hidemyphoto/.MainActivity -a\ncom.koller.secret.hidemyphoto.ACTION_LAUNCH\n\n5. Observe that:\n- The main UI of Koller Secret app is loaded on the smartphone.\n- No secret code entry is required.\n\n**Important note**:\nThe Koller Secret Pro app (with more \"advanced security features\") is also\naffected by the vulnerability, when no lockscreen protection is enabled.\n\n---\n\n*Impact*\nAn attacker exploiting this vulnerability could potentially:\n- access sensitive user data\n- bypass security controls\n- compromise application integrity\n\nSuccessful exploitation of this issue undermine the application\u0027s intended\nsecurity model, potentially allowing unauthorized access to sensitive user\ndata and negatively impacting user trust in the application.\n\n---\n\n*Disclosure Timeline*\n- 2025.11.21 \u2013 Vulnerability discovered\n- 2025.11.25 \u2013 Vendor contacted\n- 2025.11.29 \u2013 Vendor acknowledged\n- 2025.12.29 \u2013 Public disclosure\n\nThe vendor was given reasonable time to respond prior to this disclosure.\nNo malicious exploitation is known at the time of publication.\n\n---\n\n*Mitigation / Recommendation*\nTo mitigate this issue, the affected activity should not be exported unless\nexplicitly required. Setting android:exported=\"false\" for the MainActivity\nwould prevent external invocation via ADB or third-party applications.\n\nIf exporting the activity is necessary, the application should enforce\nstrict access control by validating authorization state at runtime and\nensuring that the secret code verification has been successfully completed\nbefore granting access to protected functionality.\n\nUsers are advised to update to a fixed version once available.\n\n---\n\nDiscovered and reported by:\nduykham\n\n---\n\n*References*\n- Install:\nhttps://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto\n- Install (Pro):\nhttps://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto.pro\n- Vendor: https://www.iotrusted.com\n\n---\n\nIf additional information is required, I can be reached privately.\n\nRegards,\nduykham\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:00:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/1"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto"
        },
        {
          "url": "https://play.google.com/store/apps/details?id=com.koller.secret.hidemyphoto.pro"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.iotrusted.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security Vulnerability in Koller Secret: Real Hidden App (com.koller.secret.hidemyphoto)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0002",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/1",
            "automated": true,
            "contentSha256": "f81787284493f3e97a5de826b1bc9e40b8479e55ec9a5f7da2ee9c5ee9a0c93c",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-29T21:09:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-11T11:00:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0002"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Cinegy Cinegize 2026-02-05 installer (Cinegy \nGmbH). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (BinaryFormatter deserialization) (CVSS 9.8, pre-authentication)\n\nCinegy Cinegize (2026-02-05 installer) registers a Windows service listening on TCP 51140 with a DotNetty pipeline that \ndeserializes .NET BinaryFormatter objects before the authorization handler runs. An unauthenticated remote attacker \nsends a TypeConfuseDelegate gadget frame; deserialization triggers Process.Start as LocalSystem. No authentication, no \nlicense gate, and a default inbound firewall rule make the service reachable in a default install. Dynamically verified.\n\nImpact: Full compromise of the broadcast and media-workflow automation host as LocalSystem. The attacker can disrupt \nbroadcast operations, execute arbitrary commands, and access media assets.\n\nAdvisory: https://0day-rubbish.com/blog/cinegy-cinegize-unauth-binaryformatter-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/60"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/60"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/cinegy-cinegize-unauth-binaryformatter-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/60"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (BinaryFormatter deserialization) in Cinegy Cinegize 2026-02-05 installer (Cinegy GmbH)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0123",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/60",
            "automated": true,
            "contentSha256": "8990a96469d6a144c8ca7f9fcafbbe13d8a0bec675d51d1a867783b2242c8792",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/60",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:30Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0123"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in XPressEntry 3.7.7454 (Telaeris Inc). The research \nis published and a proof-of-concept is available.\n\nPre-authentication RCE (SQL injection) (CVSS 9.8, pre-authentication)\n\nTelaeris XPressEntry 3.7.7454 runs its main HTTP API without authentication when RequireReaderCredentials is False, \nwhich is the default. The SaveVerifyActivity handler concatenates the sNotes parameter into an INSERT statement with no \nescaping. On a SQL Server backend with a sysadmin application account, an unauthenticated attacker uses a \nCOMMIT-breakout payload to enable xp_cmdshell and execute arbitrary commands as LocalSystem. Dynamically verified.\n\nImpact: Full compromise of the physical access-control and emergency-mustering system as LocalSystem. The attacker can \nalter badge records, forge or block entry events, and take over facility-security infrastructure.\n\nAdvisory: https://0day-rubbish.com/blog/telaeris-xpressentry-unauth-sqli-xpcmdshell-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:29Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/67"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/67"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/telaeris-xpressentry-unauth-sqli-xpcmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/67"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (SQL injection) in XPressEntry 3.7.7454 (Telaeris Inc)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0130",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/67",
            "automated": true,
            "contentSha256": "cec91faf2c741e53587ced1d8d970503d5a829e59e42ca3986170652b6ed94ee",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/67",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:06:02Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:29Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0130"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Scrutinizer 19.7.0 (Plixer). The research is \npublished and a proof-of-concept is available.\n\nAuthenticated RCE (SQL injection) (CVSS 8.8, authenticated)\n\nPlixer Scrutinizer 19.7.0 concatenates the HTTP orderBy parameter directly into a SQL ORDER BY clause with no escaping \nin the adminEditLang handler. The default configuration includes the pg_cron extension and a PostgreSQL SUPERUSER \ndatabase role, so an authenticated administrator can inject a side-effect expression that schedules a cron job \nexecuting arbitrary commands as the postgres user. Dynamically verified.\n\nImpact: Arbitrary command execution on the flow-analytics appliance as the postgres user inside the default privileged \ncontainer. The attacker can disrupt monitoring, access network flow data, and take control of the host.\n\nAdvisory: https://0day-rubbish.com/blog/plixer-scrutinizer-orderby-sqli-pgcron-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:26Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/66"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/66"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/plixer-scrutinizer-orderby-sqli-pgcron-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/66"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Authenticated RCE (SQL injection) in Scrutinizer 19.7.0 (Plixer)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0129",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/66",
            "automated": true,
            "contentSha256": "19fee513503623dbb02b93dfc779c6e707ec72663fa43a6037c837f26bd1821c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/66",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:48Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:26Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0129"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in DataStax Enterprise (DSE) 6.8.49 (DataStax). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nDataStax Enterprise (DSE) 6.8.49 runs a Gremlin Server on WebSocket 8182. The default configuration has the \ngremlin_server authentication section commented out, which means TinkerPop\u0027s default allowAll authenticator - no \nauthentication. The gremlin-groovy sandbox is enabled by default, but the sandbox only wraps the top-level submitted \nscript; groovy.lang.Script.evaluate(String) creates a fresh GroovyShell with a default CompilerConfiguration that does \nnot include the SandboxTransformer, so a nested string is compiled and executed sandbox-free. An attacker submits \nthis.evaluate(\"\u003cnested script\u003e\"); the nested script runs [\"/bin/sh\",\"-c\",\"\u003ccmd\u003e\"].execute().text, executing arbitrary \nsystem commands as the dse user. Dynamically verified.\n\nImpact: Full read of the host filesystem and configuration as the dse user, arbitrary OS command execution, and full \ncontrol of the DSE host and database services.\n\nAdvisory: https://0day-rubbish.com/blog/dse-gremlin-sandbox-bypass-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:50Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/52"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/52"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/dse-gremlin-sandbox-bypass-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/52"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in DataStax Enterprise (DSE) 6.8.49 (DataStax)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0115",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/52",
            "automated": true,
            "contentSha256": "5ec0b7b6a449fe6c6ef6f431db1ba851139eebc509d63d4ab9842a6b8701f2b6",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/52",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:02:47Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:50Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0115"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in RapidDeploy 5.2.2 (MidVision). The research is \npublished and a proof-of-concept is available.\n\nPre-authentication RCE (arbitrary file write) (CVSS 9.8, pre-authentication)\n\nMidVision RapidDeploy 5.2.2 ships a remote-agent template (midvision-remoting-server.xml) with host=0.0.0.0 and \nauth.servers commented out, making the JBoss Remoting layer network-reachable with no authentication. The invocation \nhandler accepts any connection and performs arbitrary-path file writes on the target host; writing a cron entry yields \nroot command execution. This is a shipped default-deployment template vulnerability. Dynamically verified.\n\nImpact: Full compromise of CI/CD target hosts as root. The attacker can overwrite deployed artifacts, inject trojans \ninto build and deploy pipelines, and take control of every managed server.\n\nAdvisory: https://0day-rubbish.com/blog/midvision-rapiddeploy-unauth-file-write-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/64"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/64"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/midvision-rapiddeploy-unauth-file-write-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/64"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (arbitrary file write) in RapidDeploy 5.2.2 (MidVision)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0127",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/64",
            "automated": true,
            "contentSha256": "fc0393166254f6d5713a53b47d9f607569d48138ab4898e4f9a03efadd28761f",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/64",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:22Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0127"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Lansweeper 12.2.1.0 (web reports 12.2.1.6) \n(Lansweeper). The research is published and a proof-of-concept is available.\n\nAuthenticated RCE (second-order SQL injection) (CVSS 8.8, authenticated)\n\nLansweeper 12.2.1.0 contains a second-order SQL injection in the LicenseActions console. A SQL Server sub-server name \ncontaining a single quote is stored and later concatenated unescaped into a NOT LIKE clause; the query is executed with \nstacked statements, enabling EXEC xp_cmdshell. The default lansweeperuser database account is SQL Server sysadmin and \nxp_cmdshell is enabled by default, so an authenticated administrator achieves remote code execution. Dynamically \nverified.\n\nImpact: Full compromise of the Lansweeper server. The attacker can execute arbitrary commands, read scanned asset and \ncredential data, and pivot into the managed network.\n\nAdvisory: https://0day-rubbish.com/blog/lansweeper-licenseactions-sqli-xpcmdshell-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:19Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/63"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/63"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/lansweeper-licenseactions-sqli-xpcmdshell-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/63"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Authenticated RCE (second-order SQL injection) in Lansweeper 12.2.1.0 (web reports 12.2.1.6) (Lansweeper)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0126",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/63",
            "automated": true,
            "contentSha256": "b79a652e47cb35bc955ae62909cd8888ae1638681369ff80f25aed940287ed33",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/63",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:09Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:19Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0126"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Output Messenger Server 2.0.x (\u003e= 2.0.63) (Srimax \nSoftware (Output Technology)). The research is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (Zip-Slip plugin planting) (CVSS 9.8, pre-authentication)\n\nOutput Messenger Server 2.0.x accepts XMPP connections on TCP 14121 with no SASL and no credentials; every connection \nis treated as authenticated. Through linkserver registration and the file-transfer listener, an unauthenticated \nattacker uploads a crafted ZIP whose entries escape the plugin directory (Zip-Slip in SharpZipLib 0.85.4). On service \nrestart, the planted plugin constructor executes as LocalSystem. Dynamically verified.\n\nImpact: Full compromise of the on-premise enterprise instant-messaging server as LocalSystem. The attacker can read \ncorporate communications, execute arbitrary commands, and move laterally inside the office network.\n\nAdvisory: https://0day-rubbish.com/blog/output-messenger-unauth-zipslip-plugin-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:24Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/65"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/65"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/output-messenger-unauth-zipslip-plugin-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/65"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) in Output Messenger Server 2.0.x (\u003e= 2.0.63) (Srimax Software (Output Technology))",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0128",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/65",
            "automated": true,
            "contentSha256": "1a92cd811d62d57463faa0478429c3f7161b89c57498277dd6b0195e0eb81e9d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/65",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:05:35Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:24Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0128"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in PulseNET Enterprise 6.0.3 (build 6975) (GE \nVernova). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (default credentials + path traversal) (CVSS 9.8, pre-authentication)\n\nGE Vernova PulseNET Enterprise 6.0.3 is the network-management software electric utilities use to monitor and manage \nthe industrial wireless networks connecting substations and distribution automation. It ships with factory-default \nadmin/admin credentials with no forced password change, and the resource-management console builds the target file path \nby raw string concatenation with no normalization. Because Tomcat runs as root with autoDeploy enabled, an attacker can \nupload a JSP file into a new web application directory and execute arbitrary commands as root. Dynamically verified \nwith uid=0(root).\n\nImpact: Full compromise of the power-network management host as root. The attacker can read the host filesystem, \nexecute arbitrary commands, and gain control of the system a utility relies on to manage communications with its grid.\n\nAdvisory: https://0day-rubbish.com/blog/ge-pulsenet-resource-file-path-traversal-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:14Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/61"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/61"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/ge-pulsenet-resource-file-path-traversal-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/61"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (default credentials + path traversal) in PulseNET Enterprise 6.0.3 (build 6975) (GE Vernova)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0124",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/61",
            "automated": true,
            "contentSha256": "9f220ea30cccbbd4ef2f593c8bfa113c8f77c77556b539fb712b77c2abe81c54",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/61",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:43Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:14Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0124"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, \nInc.). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nConfluent Platform 7.9.1-ce exposes an unauthenticated remote code execution chain in its default configuration. ksqlDB \n(HTTP 8089), the Kafka broker (9092 PLAINTEXT, no SASL) and Kafka Connect (8083) all accept requests without \nauthentication. An attacker submits a CREATE SINK CONNECTOR statement to ksqlDB using FileStreamSinkConnector with an \nattacker-controlled file path and StringConverter, then produces arbitrary bytes to the subscribed Kafka topic through \nthe unauthenticated broker. The connector appends each message to the target file; writing a cron line to /etc/cron.d/ \nyields arbitrary command execution as root when crond runs. Dynamically verified with uid=0(root).\n\nImpact: Arbitrary command execution as root (the ksqlDB/Connect process user); the attacker can read or destroy data on \nthe host, persist access, and take full control of the Confluent deployment. No credentials are required.\n\nAdvisory: https://0day-rubbish.com/blog/ksqldb-unauth-sink-connector-cron-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/55"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/55"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/ksqldb-unauth-sink-connector-cron-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/55"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, Inc.)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0118",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/55",
            "automated": true,
            "contentSha256": "e7fed5aea4defd00047e128e708b62970bd2d623d56ed95d2584eebf55081902",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/55",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0118"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity)). \nThe research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nWyn Enterprise 9.1.00145.0 exposes an unauthenticated root RCE chain of three vulnerabilities: JWT signature validation \nis skipped (parse-only ReadToken) with a hardcoded integration client secret, producing an unauthenticated 10-year \nadmin reference token; the import endpoint allows a zip-slip arbitrary file write (a malicious DLL can be dropped into \nthe security-provider folder); and the security-provider loader scans DLLs and calls Activator.CreateInstance on the \nparameterless constructor, running as root. All three are reachable without credentials in the default configuration. \nDynamically verified with root RCE.\n\nImpact: Full host compromise as root (the dotnet container process); the attacker can read the host filesystem, execute \narbitrary commands, and take full control of the Wyn server.\n\nAdvisory: https://0day-rubbish.com/blog/wyn-enterprise-unauth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/59"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/59"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/wyn-enterprise-unauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/59"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity))",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0122",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/59",
            "automated": true,
            "contentSha256": "22d821eb4cbc90b4cd35522f655d8d9edeadafe263eeb62960f825ccd189ed0e",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/59",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:17Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0122"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in iMonnit Express 4.0.5.5 (Monnit / iMonnit). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\niMonnit Express 4.0.5.5 is an ASP.NET Core application running as a Windows service with LocalSystem privileges, with \nno global [Authorize] filter. Three flaws combine into a fully unauthenticated root RCE chain: an auth bypass (an empty \nsecurity answer list issues a valid admin cookie), a path-traversal file write in the certificate upload endpoint \n(reachable with the forged cookie), and a plugin loader that calls Assembly.Load + Activator.CreateInstance on the \nplugin\u0027s parameterless constructor BEFORE the IExpressPlugin check - the constructor runs as LocalSystem. Dynamically \nverified: whoami = nt authority\\system.\n\nImpact: Full read of the host filesystem and configuration as NT AUTHORITY\\SYSTEM, arbitrary OS command execution, and \nfull control of the iMonnit Express host.\n\nAdvisory: https://0day-rubbish.com/blog/imonnit-express-unauth-plugin-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/54"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/54"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/imonnit-express-unauth-plugin-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/54"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in iMonnit Express 4.0.5.5 (Monnit / iMonnit)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0117",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/54",
            "automated": true,
            "contentSha256": "62f141d0cd4f591221ed21a7ea4783e9ca3951258d868eace70668e4b363e7aa",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/54",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:13Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0117"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI \nSoftware). The research is published and a proof-of-concept is available.\n\nAuthenticated RCE (command injection) (CVSS 8.8, authenticated)\n\nKerio Connect 10.0.9 Patch 2 contains a command-injection vulnerability in the WebAdmin JSON-RPC method \nServer.startEncryption. The password parameter is double-quoted and concatenated unescaped into a cryptsetup shell \ncommand that is executed via system() during volume encryption. Because the mail server process runs as root, a \nFullAdmin user can break out of the quotes and execute arbitrary commands as root. Dynamically verified.\n\nImpact: Arbitrary command execution as root on the mail server host. An attacker with admin access can read mail stores \nand credentials, disrupt mail service, and take full control of the server.\n\nAdvisory: https://0day-rubbish.com/blog/kerio-connect-startencryption-cmd-injection-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:16Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/62"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/62"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/kerio-connect-startencryption-cmd-injection-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/62"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Authenticated RCE (command injection) in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI Software)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0125",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/62",
            "automated": true,
            "contentSha256": "b0b733a44be713389f07ff0988bf577c28e3a4030ce1b4c1974d4a7b66b21fe4",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/62",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:56Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:16Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0125"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in nanoDLP stable build #10729 (Nano3Dtech). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nnanoDLP exposes an unauthenticated remote code execution vulnerability. The Guest (unauthenticated) endpoint POST \n/formula evaluates user-supplied JavaScript in an embedded Otto JS sandbox, which exposes a live nanoDLP domain object \nvia nanodlpContext(). The Config object is a cross-request shared live pointer; Config.ShieldUnpause is writable, and \nConfig.Save() persists it to db/machine.json without sanitization. An attacker injects [[Exec \u003ccmd\u003e]] into \nShieldUnpause, then the also-unauthenticated GET /printer/unpause triggers the print engine to execute the G-code, \nreaching os/exec with shell semantics as root. Dynamically verified with uid=0(root).\n\nImpact: Full read of the host filesystem and configuration as root, arbitrary OS command execution, and full control of \nthe print server and host. The injected G-code is persisted and re-executes on every unpause.\n\nAdvisory: https://0day-rubbish.com/blog/nanodlp-unauth-gcode-injection-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/57"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/57"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/nanodlp-unauth-gcode-injection-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/57"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in nanoDLP stable build #10729 (Nano3Dtech)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0120",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/57",
            "automated": true,
            "contentSha256": "311e7dc120b27dccd2a21cc671849c884ae669888482809cc8e55f1638e05953",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/57",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:51Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0120"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Ontotext GraphDB 11.4.3 Free edition (Ontotext / \nGraphwise). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nOntotext GraphDB 11.4.3 Free edition defaults to security=false, which bypasses the entire Spring Security filter \nchain. As a result, /rest/repositories/ruleset/upload and /repositories/* are anonymously reachable. A .pie ruleset \nupload is compiled at runtime by the system javac and loaded into the server process. RuleCompilerBase.compilePrefices \ninlines the namespace prefix verbatim into the generated Java source with only .trim() and no validation. An attacker \ninjects Java code in the prefix; creating a graphdb:Sail repository triggers infer.initialize(), which executes the \ninjected Runtime.exec as the GraphDB process user (root). No authentication and no license are required. Dynamically \nverified with uid=0(root).\n\nImpact: Full host compromise as root (the GraphDB process user); the attacker can read any file, execute arbitrary \ncommands, and take full control of the GraphDB host and its repositories.\n\nAdvisory: https://0day-rubbish.com/blog/graphdb-pie-unicode-escape-unauth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/53"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/53"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/graphdb-pie-unicode-escape-unauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/53"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Ontotext GraphDB 11.4.3 Free edition (Ontotext / Graphwise)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0116",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/53",
            "automated": true,
            "contentSha256": "d1819df0ca4a56f1374c818730f46e330e087eab2119aa5cb776a0327e2b620d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/53",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:00Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0116"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in MAPS SCADA 4.0.5.5 (Adroit Technologies). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nMAPS SCADA 4.0.5.5 exposes an IIS WebService (default port 8878) whose WSDataProvider.asmx endpoints deserialize the \ncaller-supplied byte array before any authentication. Serializer.BinaryDeserialization internally calls new \nBinaryFormatter().Deserialize(stream) with no SerializationBinder and no TypeFilterLevel. An attacker sends a single \nunauthenticated HTTP SOAP POST carrying a GZip-compressed BinaryFormatter gadget (TypeConfuseDelegate -\u003e \nProcess.Start), achieving arbitrary command execution as the IIS app pool identity - NT AUTHORITY\\SYSTEM in the default \ndeployment. Dynamically verified.\n\nImpact: Full compromise of the SCADA host as NT AUTHORITY\\SYSTEM; the attacker can read any file, execute arbitrary \ncommands, and take full control of the SCADA environment.\n\nAdvisory: https://0day-rubbish.com/blog/maps-scada-unauth-binaryformatter-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:50:59Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/56"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/56"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/maps-scada-unauth-binaryformatter-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/56"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in MAPS SCADA 4.0.5.5 (Adroit Technologies)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0119",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/56",
            "automated": true,
            "contentSha256": "da970b16449b913dd2e753b4f0f695fcdf14739866217cd694117b71e45d2ad8",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/56",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:03:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:50:59Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0119"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in ObjectDB 2.9.5 server mode (ObjectDB Software). \nThe research is published and a proof-of-concept is available.\n\nPre-authentication RCE (default credentials) (CVSS 9.8, pre-authentication)\n\nObjectDB 2.9.5 server mode (port 6136, proprietary binary protocol) has a critical remote code execution vulnerability: \nJDOQL query filter evaluation allows arbitrary static-method reflective invocation. Factory default credentials \nadmin/admin grant full privileges with no forced change; the IP check accepts any source IP when the user has no ip \nattribute. A malicious JDOQL filter such as java.lang.Runtime.getRuntime().exec(cmd) != null is evaluated server-side: \nQNF.q() loads any class (no class-name allowlist), MCN.l() calls Method.invoke with setAccessible(true), reaching \nRuntime.exec - the server-side Java process runs as root, yielding uid=0(root) RCE. Dynamically verified.\n\nImpact: Full read of the host filesystem and JVM environment as root, arbitrary OS command execution, and full control \nof the ObjectDB host and database.\n\nAdvisory: https://0day-rubbish.com/blog/objectdb-jdoql-injection-root-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:51:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/58"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/58"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/objectdb-jdoql-injection-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/58"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE (default credentials) in ObjectDB 2.9.5 server mode (ObjectDB Software)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0121",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/58",
            "automated": true,
            "contentSha256": "7504b3d42652b55eb3bd0b8ba381dce0ecbca0da8a5d07703ccebe0524bf7d33",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/58",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-18T06:04:05Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:51:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0121"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in AOMEI Cyber Backup v2.3.0 (AOMEI). The research is \npublished and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nAOMEI Cyber Backup v2.3.0 runs as root in a Docker container and exposes four Thrift binary-protocol ports, but only \nthe 9072 Gateway enforces JWT authentication. The three internal Thrift ports (9074, 9077, 9078) bind to the container \nnetwork with no authentication handler. An attacker who can reach ports 9074 and 9078 persists an injected NAS \ncredential via AddBackupStorageNAS, then triggers DeleteBackupStorage, whose async lambda builds a CIFS mount command \nvia system() with unescaped username and password fields. A single-quote escape in the username field injects an \narbitrary shell command that executes as root (uid=0). The chain requires only network reachability to the internal \nThrift ports; no credentials and no user interaction are required.\n\nImpact: Arbitrary command execution as root (uid=0) inside the backup infrastructure container; the attacker can read \nbackup metadata and stored credentials, alter backup storage records, and disrupt or destroy backup operations.\n\nAdvisory: https://0day-rubbish.com/blog/aomei-cyber-backup-thrift-nas-mount-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:01Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/3"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/aomei-cyber-backup-thrift-nas-mount-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in AOMEI Cyber Backup v2.3.0 (AOMEI)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0051",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/3",
            "automated": true,
            "contentSha256": "2d677b0e8b05bc9a486a16164155baf0f0f0c8dc765a31eb2c875bb214157a44",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:34:19Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:01Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0051"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 \n(CIRCUTOR S.A.). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nThe native engine PwrStudio.exe runs as the Windows service CircutorPowerStudioScadaServer under NT AUTHORITY\\SYSTEM. \nThe shared fail-open JWT library (see companion advisory) accepts a forged alg=none JWT with role=Admin. Combined with \na path-traversal write of a malicious default.xeve events configuration (containing a shellExecute action) against \nPSSWidgets (port 8105) and an HTTP engine restart against PSSAdministrator (port 8089), an unauthenticated attacker \nforces the engine to reload the configuration and fire XCEventActionShellExecute::Execute, which reaches CreateProcessW \nwith attacker-controlled arguments as SYSTEM. Under a strict default deployment where 8089 is loopback-only with no \nforwarding path, the chain does not close for a pure-remote unauthenticated attacker; once 8089 is reachable (reverse \nproxy, rebind, same-host, or same segment), it is a full unauthenticated remote SYSTEM RCE.\n\nImpact: Arbitrary command execution as NT AUTHORITY\\SYSTEM on the SCADA host; the attacker controls the SCADA engine, \nthe event configuration, and the underlying Windows host.\n\nAdvisory: https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce\n\nVulnerability 2: JWT forgery / authentication bypass (CVSS 8.6, pre-authentication)\n\nEvery .NET Core microservice registers JWT Bearer authentication via a shared extension method configured fail-open: a \ncustom SignatureValidator that always returns a non-null token without validating the signature, \nRequireSignedTokens=false, ValidateIssuerSigningKey=false, ValidateIssuer=false, ValidateAudience=false, and an \nOnAuthenticationFailed handler that silently swallows exceptions. Any attacker-crafted alg=none JWT with any role claim \nis accepted as a valid authenticated identity by every microservice\u0027s AdminSecure/UserSecure policy. No credentials, no \nsigning key, and no user account are required; only network reachability to the target microservice port. This is an \nauthentication-bypass/identity-forgery primitive that compromises the product\u0027s entire authentication trust root and is \nthe auth-bypass primitive that enables the companion shellExecute RCE chain.\n\nImpact: Impersonate any Admin/User role and call any protected endpoint: stop/start the SCADA engine or microservices \n(DoS), push configuration, upload/download/delete files, configure external communication, and manage licenses; no \ncredentials required.\n\nAdvisory: https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:11Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/8"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/circutor-powerstudio-jwt-alg-none-identity-forgery"
        },
        {
          "url": "https://0day-rubbish.com/blog/circutor-powerstudio-unauth-shellExecute-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including JWT forgery / authentication bypass, Pre-authentication SYSTEM RCE in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0 (CIRCUTOR S.A.)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0055",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/8",
            "automated": true,
            "contentSha256": "58e108022707975fd14683eff98ee10fc1c059144d9993ff6ca49b14208bced2",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:11Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0055"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "LOMOSITS.Daniel via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Reference: https://seclists.org/fulldisclosure/2026/Aug/5\n\nI tested both vulnerabilities against a clean installation of atvise SCADA 3.13.0. Results differ between the two \nfindings.\n\n---\n\nVulnerability 1 (OPC UA pre-authentication root RCE, CVSS 9.8) - NOT REPRODUCIBLE\n\nThe ActivateSession step - identified as the authentication bypass entry point - returns BadUserAccessDenied:\n\n    WebMI login(root, bogus) -\u003e 200 {\"error\":-1,\"errorstring\":\"Invalid Session or Digest\"}\n        [+] root has a strong password (bogus login rejected)\n    [Step 1] OPC UA 4840 ActivateSession(root, bogus) -- authentication bypass\n    ServiceFault (BadUserAccessDenied, diagnostics: DiagnosticInfo(\n      SymbolicId=None, NamespaceURI=None, Locale=None,\n      LocalizedText=None, AdditionalInfo=None,\n      InnerStatusCode=None, InnerDiagnosticInfo=None))\n    from server received in response to ActivateSessionRequest\n\nThe OPC UA backend rejects the bogus password and does not yield a superuser session, contrary to the advisory\u0027s claim \nthat logonSessionUser never calls the password-verification function.\n\nNote for anyone attempting independent reproduction: the advisory\u0027s license note discloses that the research was \nconducted against a binary-patched installation (patch 5: isLicensed() forced to 1; patch 6: session-count bypass). \nWhether OPC UA authentication behaviour differs between the patched binary and an unmodified licensed installation \nremains the open question. If the 0day Rubbish Research Team can clarify whether the ActivateSession step was verified \nagainst the original unpatched binary, that would help resolve the discrepancy.\n\n---\n\nVulnerability 2 (WebMI default-credential RCE, CVSS 8.8) - REPRODUCIBLE\n\nConfirmed. login(root, \u003cany value\u003e) returns {\"username\":\"root\"} on a factory-default installation. The handleLogin \n\u0027password not set\u0027 branch behaves exactly as described. Setting a strong root password via changepassword closes the \nbypass.\n\nMit freundlichen Gr\u00fc\u00dfen\nWith kind regards\n\nIng. Daniel Lomosits MSc MBA BSc\nProduct Manager\n\nP +43 (0)2682 / 75799-2829 M +43 (0) 676 / 702 80 87 | daniel.lomosits () bachmann info\u003cmailto:daniel.lomosits () \nbachmann info\u003e | www.bachmann-visutec.com\u003chttp://www.bachmann-visutec.com/\u003e\n\n[cid:image001.png@01DD2E3D.5EAA1330]\u003chttps://atvise.com/\u003e\n\nRegistered Office:\nBachmann Visutec GmbH, Kasernenstra\u00dfe 29, 7000 Eisenstadt, Austria\nFN 274018v Commercial Register Eisenstadt | ATU 62240738\nCorporate Headquarters:\nBachmann electronic GmbH, Kreuz\u00e4ckerweg 33, 6800 Feldkirch, Austria\nFN 75348g Commercial Register Feldkirch | ATU 36410905\n\nDokumente mit rechtsverbindlichem Inhalt sind nur mit Originalunterschrift wirksam.\nDocuments with legally binding subject matter are valid only with original hand-written signature.\n\nFollow Bachmann on  Facebook\u003chttps://www.facebook.com/Bachmann.electronic/\u003e |  \nLinkedIn\u003chttps://www.linkedin.com/company/bachmann-electronic-gmbh\u003e |  Twitter\u003chttps://twitter.com/bachmann_corp\u003e |  \nXing\u003chttps://www.xing.com/companies/bachmannelectronicgmbh\u003e |  \nYouTube\u003chttps://www.youtube.com/channel/UCE5LllKmEA5ZtBnsIpvVqxg\u003e\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:49:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/39"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/39"
        },
        {
          "url": "http://www.bachmann-visutec.com/"
        },
        {
          "url": "https://atvise.com/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/2026/Aug/5"
        },
        {
          "url": "https://twitter.com/bachmann_corp"
        },
        {
          "url": "https://www.facebook.com/Bachmann.electronic/"
        },
        {
          "url": "https://www.linkedin.com/company/bachmann-electronic-gmbh"
        },
        {
          "url": "https://www.xing.com/companies/bachmannelectronicgmbh"
        },
        {
          "url": "https://www.youtube.com/channel/UCE5LllKmEA5ZtBnsIpvVqxg"
        },
        {
          "url": "mailto:daniel.lomosits"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/39"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0031",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/39",
            "automated": true,
            "contentSha256": "b464e33cfb97e6aeb144887f62b793310a01e8e379d3f8eb9852a05dd2a1e3d3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/39",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-17T11:42:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:49:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0031"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Plastic SCM (Unity Version Control On-Prem) \n11.0.16.10303 (Unity Technologies). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nPlastic SCM ships a self-developed binary version-control protocol on port 8087, reachable by default on 0.0.0.0. Under \nthe default NameWorkingMode, the server validates only that a client-declared username maps to a local OS account and \nnever checks a password; LocalGroupSEIDProvider.CheckPassword is an empty no-op. Combined with a default EVERYBODY ACL \nthat grants ALL_PERMISSIONS (including mktrigger) to any name-only-authenticated user, an unauthenticated attacker can \ndeclare an administrative username (leaked unauthenticated via GetRepositoryServerInfo), create a server-side trigger \nwhose Path is fully attacker-controlled, and trigger it with a repository operation. TriggerProcess.ExecuteTrigger \nfeeds the Path straight into Process.Start as the FileName with no sandbox, path allowlist, or signature check, \nyielding RCE as the plasticd service account (Linux: plasticscm uid=217; Windows: local Administrator). The only \nnon-network prerequisite is one local OS username, which the protocol itself leaks.\n\nImpact: Full compromise of the version-control server and all repositories, and arbitrary command execution as the \nplasticd service account; the attacker can read source code and repository metadata, create triggers, alter \nrepositories, and persist access.\n\nAdvisory: https://0day-rubbish.com/blog/plastic-scm-unauth-8087-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:16Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/10"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/10"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/plastic-scm-unauth-8087-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/10"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Plastic SCM (Unity Version Control On-Prem) 11.0.16.10303 (Unity Technologies)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0057",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/10",
            "automated": true,
            "contentSha256": "d8eb1511379fda3c83f3f27587a57b37c7909e304d0ec7cd0c86743d790d8c32",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/10",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:36:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:16Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0057"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Stimulsoft Server 2026.3.1 (Stimulsoft). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nA default-configuration defect chain combines into a complete unauthenticated RCE. The /1/signup endpoint is open by \ndefault with email activation disabled, so an anonymous attacker registers and immediately receives a Supervisor \naccount. The Supervisor uploads a .mrt report template containing an embedded C# script. PUT \n/1/reporttemplates/\u003cid\u003e/run triggers the report-script engine, which compiles the script with CSharpCodeProvider in \nfull trust (no AppDomain isolation, no CAS sandbox, no class allowlist) and instantiates the report class, executing \nthe attacker-controlled constructor. The report task runs in the backend service process Stimulsoft.Server.Agent.exe as \nNT AUTHORITY\\SYSTEM. No credentials, no SMTP, no administrator action, and no non-default configuration are required.\n\nImpact: Full system takeover; the report task executes in the backend service process running as NT AUTHORITY\\SYSTEM, \ngiving arbitrary code execution with the highest Windows privilege.\n\nAdvisory: https://0day-rubbish.com/blog/stimulsoft-server-unauth-report-script-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:14Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/9"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/stimulsoft-server-unauth-report-script-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in Stimulsoft Server 2026.3.1 (Stimulsoft)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0056",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/9",
            "automated": true,
            "contentSha256": "e93aa4f24d03c1931d3cd8b6dd3af1323819c4d983936a8ff51957fff654f1c7",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:36:18Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:14Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0056"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd). The \nresearch is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nvMix 29 ships a Windows-native .NET Framework application with a built-in Web Controller HTTP server on port 8088. The \nHTTP API endpoint GET /api/?Function=ScriptStartDynamic\u0026Value=\u003cVB.NET source\u003e takes the Value parameter as VB.NET \nsource code, compiles and executes it via VBScriptProvider.Compile. vMix attempts to sandbox user-supplied scripts with \na 6-item substring blocklist, but the compilation template injects Imports System.Diagnostics into the generated source \nbefore the user\u0027s code, so an attacker can call Process.Start directly without writing the blocked substring. Combined \nwith the Web Controller\u0027s default blank password (which the official documentation states means no login will be \nrequired regardless of the access settings), the entire /api route is reachable without authentication, yielding \nunauthenticated RCE as the user running vMix64.exe (commonly administrator). Pre-research public CVE count for vMix: 0.\n\nImpact: Arbitrary OS command execution as the vMix64.exe run identity (commonly administrator), plus arbitrary file \nread/write via the same blocklist bypass; no credentials required.\n\nAdvisory: https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/12"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/vmix-vbscript-blocklist-bypass-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in vMix 29 v29.0.0.48 (Studio Coast Pty Ltd)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0059",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/12",
            "automated": true,
            "contentSha256": "1df256062c2f41c79c2944d415b239febfede190eab238ad05d63e79486a530d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0059"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon \nIndustries). The research is published and a proof-of-concept is available.\n\nPre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)\n\nVicon Valerus ViconNet Gateway ships an ASP.NET Web API (OWIN self-host, VII.NVR.Host.exe Windows service) bound to \n/NVR/api/v1 on ports 8084/8444. The endpoint POST /NVR/api/v1/upgrades/multiformat-file-Execute/start receives a \n[FromBody] string cmd, concatenates it directly to cmd.exe /c, and invokes Process.Start. None of the 8 OWIN \nmiddlewares perform authentication, UpgradesController is not annotated with [Authorize], and SetupExecuteCommand \nbypasses the UpgradeAuthorizationFlag gate that protects the sibling Upgrade() method. The service runs as LocalSystem, \nso an unauthenticated attacker with network access to the Web API port immediately obtains nt authority\\system remote \ncode execution.\n\nImpact: Full host compromise as nt authority\\system with no credentials required; the attacker can access all recorded \nvideo, camera credentials, and VMS configuration, alter video surveillance state, and tamper with or destroy evidence.\n\nAdvisory: https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:18Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/11"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/vicon-valerus-unauth-cmd-injection-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication SYSTEM RCE in Vicon Valerus ViconNet Gateway 25.200.46.0 (Vicon Industries)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0058",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/11",
            "automated": true,
            "contentSha256": "4bca9118108632e68858fe19a14bea30d3ae2f8f7886c0c397caf138b0225f2a",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:18Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0058"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in Xeams 10.3 build 6449 (Synametrics \nTechnologies). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nA framework-level debug write primitive in the rules engine reads an attacker-controlled MIME header, \nX-SM_SAVE_BODY_4DEBUGGING, as an absolute file path and the message body as the file content, writing to any path on \nthe host with no validation, no allowlist, and no authentication gate. The SMTP service accepts unauthenticated \ndelivery by default (reqAuthForLocal=false is the global default). When Xeams runs as root, an attacker writes a cron \njob into /etc/cron.d/, which crond executes as root every minute, yielding a complete unauthenticated root RCE. The \nentire chain depends only on SMTP, requires no HTTP and no credentials, and was dynamically verified on both port 25 \nand port 587 producing uid=0(root).\n\nImpact: Arbitrary root command execution on the mail server host, full root read of the Xeams mail repository (all .eml \nenvelope/subject/body), and complete control of the Xeams process; no credentials required.\n\nAdvisory: https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce\n\nVulnerability 2: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nThe built-in SQLRunner.jsp administrative page is directly reachable without authentication: web.xml declares no \nsecurity-constraint for JSPs, the SynaFilter maps only /FrontController/*, and NewPageHeader.jsp does not enforce \nauthentication. Directly requesting SQLRunner.jsp bypasses the FrontController dispatch, the SynaFilter, and the \noperation-level authorization. The operation=1 branch performs no auth check and connects to the embedded Derby \ndatabase using attacker-supplied credentials; Xeams hardcodes the Derby database-owner credentials system/manager, so \nan attacker reuses them. With the JDBC connection stored in the HTTP session, operation=2 issues arbitrary SQL, and \ncalling the Derby procedure SYSCS_UTIL.SYSCS_EXPORT_QUERY writes an attacker-controlled JSP webshell into the Tomcat \nwebapps/ROOT docBase. A subsequent GET triggers Jasper on-demand compilation and execution, yielding arbitrary command \nexecution at the Xeams process privilege (root in the default deployment). The chain requires only HTTP access to the \nXeams web port (default 5272/TCP), no valid login, no CSRF token, and no prior session. The RCE was dynamically \nverified end-to-end producing uid=0(root).\n\nImpact: Arbitrary command execution on the mail server host at the Xeams process privilege (root in the default \ndeployment), full read of the Xeams mail repository and the host filesystem, and complete control of the Xeams process \nand embedded Derby database.\n\nAdvisory: https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:23Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/13"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/13"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/xeams-smtp-savebody-cron-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/xeams-unauth-sqlrunner-derby-jsp-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/13"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Pre-authentication root RCE in Xeams 10.3 build 6449 (Synametrics Technologies)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0060",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/13",
            "automated": true,
            "contentSha256": "0677fda4e29c7284466913132fa5d7f43fce586521bbff2ddab08fe54750a146",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/13",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:37:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:23Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0060"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 3 vulnerabilities in CatDV Server 10.7.8 (Square Box Systems). The \nresearch is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nA three-defect chain turns any deployment into an unauthenticated root RCE. An RMI connect(null) path makes the server \nmint a ClientID using its own internal client.regcode system property (zero attacker credentials). A saveSettings \nmethod gated only by that ClientID with no admin check writes an attacker-controlled catdv.aaftoolPath into the JVM \nsystem properties. An AAFExportHandler ProcessUtils.exec sink runs that path as root on every AAF export request. The \nfactory-default empty admin password closes the chain by supplying the admin session needed to reach the AAF trigger. \nDynamic verification produced uid=0(root).\n\nImpact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); the attacker holds no \nproduct license key and no user credentials.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce\n\nVulnerability 2: Hardcoded credentials (CVSS 9.8, pre-authentication)\n\nThe factory-default database seed creates the built-in admin user with password=0 and passwordHash=NULL. The password \nverification routine skips the PBKDF2 path when passwordHash is null and falls back to a legacy simpleMD5Hash path, \nwhere simpleMD5Hash(\u0027\u0027) returns 0 and 0 == 0 evaluates to true. Anyone who can reach the CatDV web login endpoint can \nauthenticate as the administrator using admin with an empty password, as long as the factory default has not been \nchanged. This grants full administrator control of the MAM server and is the credential prerequisite for the \nauthenticated root RCE chain.\n\nImpact: Full administrator takeover of the CatDV server using the well-known built-in admin username with an empty \npassword; the admin session can read or alter any catalog data, server configuration, or user account.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password\n\nVulnerability 3: Authenticated RCE (property injection) (CVSS 7.6, authenticated)\n\nAn authenticated administrator can turn any running deployment into a root RCE by injecting the catdv.aaftoolPath JVM \nsystem property to point at an attacker-controlled script and then triggering an AAF export. The type-23 \n\u0027server-config\u0027 setting is applied verbatim as System.setProperty(key, value) pairs with no property whitelist, and \nAAFExportHandler runs that property via ProcessUtils.exec as root on every AAF export request. The injected property is \nauto-applied on the next request (1s throttle), so no server restart is needed. Dynamic verification produced \nuid=0(root).\n\nImpact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); an admin session on the \nweb API is required.\n\nAdvisory: https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/6"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password"
        },
        {
          "url": "https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/6"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Authenticated RCE (property injection), Hardcoded credentials, Pre-authentication root RCE in CatDV Server 10.7.8 (Square Box Systems)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0054",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/6",
            "automated": true,
            "contentSha256": "fcc939a21fe54550bf830f81863d367df0c4c732c3286455b68ac1bbeac4087b",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/6",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0054"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory Pre-authentication",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Apache Struts 2 2.6.11.0 (Apache Software \nFoundation). The research is published and a proof-of-concept is available.\n\nPre-authentication RCE (CVSS 9.8, pre-authentication)\n\nApache Struts 2.6.11.0 is vulnerable to unauthenticated remote code execution under a documented REST mapper \nconfiguration combined with wildcard dynamic dispatch. RestfulActionMapper.getMapping() extracts the action name from \nthe request URI without calling cleanupActionName, the character-set gate that DefaultActionMapper adopted after \nS2-057; that fix was never synchronized to the REST mapper. When an application uses struts.mapper.class=restful with a \nwildcard action and a result containing {1} substitution, attacker-controlled OGNL metacharacters flow through the \nwildcard capture into TextParseUtil.translateVariables, bypassing AcceptedPatternsChecker. A novel \njava.beans.Expression/Statement reflection primitive then defeats the SecurityMemberAccess sandbox and reaches \nRuntime.exec. The chain was verified with uid=0(root) on a Tomcat 9 / OGNL 3.3.5 deployment. The only precondition is \nan opt-in but documented configuration subset (REST mapper plus wildcard dynamic dispatch).\n\nImpact: Arbitrary operating system command execution as the JVM process user; on a root-run deployment, full host \ncompromise. No credentials are required.\n\nAdvisory: https://0day-rubbish.com/blog/apache-struts2-restful-mapper-ognl-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:03Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/4"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/apache-struts2-restful-mapper-ognl-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: Pre-authentication RCE in Apache Struts 2 2.6.11.0 (Apache Software Foundation)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0052",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/4",
            "automated": true,
            "contentSha256": "fee326014012576665558b465357a6f742a6c51511c5aadf16abb7a461350217",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:34:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:03Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0052"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "advisory",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing 2 vulnerabilities in atvise SCADA 3.13.0 (atvise GmbH / Bachmann \nVisutec). The research is published and a proof-of-concept is available.\n\nVulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)\n\nThe main service process atserver runs as root and exposes two independent authentication backends: a WebMI HTTP \nbackend that verifies passwords, and an OPC UA binary protocol backend on port 4840 that does not. The OPC UA \nlogonSessionUser path never calls the password-verification function; it only checks that the \nSYSTEM.SECURITY.USERS.\u003cusername\u003e node exists. Any non-empty password for root yields a superuser session, even under a \nstrong root password. The chain combines this auth bypass with an OPC UA write that overwrites a built-in WebMI \nmethod\u0027s V8 script, an anonymous WebMI session built via a digest bypass, and an anonymous POST that triggers the \ntampered V8 script. The V8 engine runs inside atserver (root), so the injected script inherits root and executes \narbitrary commands. The chain was verified by reading /etc/shadow. The only precondition is that the WEBACCESS module \nis loaded, which is the normal running state of a licensed production deployment.\n\nImpact: Complete host compromise as root; the attacker can read any file, execute arbitrary commands, and alter SCADA \ncontrol logic and node values.\n\nAdvisory: https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce\n\nVulnerability 2: Default-credential RCE (CVSS 8.8, authenticated)\n\nThe WebHMI service (Boost.Beast HTTP on ports 80/443) uses a custom WebMI authentication scheme. The built-in root user \nships with a factory default empty password, and the handleLogin handler has a \u0027password not set\u0027 branch that grants \nthe superuser session for an existing user without verifying the supplied passwords while that default state is in \nplace. The chain combines the default-credential login (login(root, any value) yields the root superuser session), a V8 \nScriptCode injection via AddNode, a ReportRunConfiguration trigger that loads the attacker script into the embedded V8 \nengine, and a ChildProcess.execAsync payload. The V8 engine runs inside atserver (root), so the injected script \ninherits root. Setting a strong root password via changepassword closes the login bypass. The only precondition is that \nthe WEBACCESS module is loaded.\n\nImpact: Complete host compromise as root; the attacker can read any file, execute arbitrary commands, and alter SCADA \ncontrol logic and node values.\n\nAdvisory: https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce\n\nPoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish\n\n-- \n0day Rubbish Research Team\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:37:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/5"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/atvise-scada-opcua-unauth-rce"
        },
        {
          "url": "https://0day-rubbish.com/blog/atvise-scada-webmi-auth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Security advisory: multiple vulnerabilities including Default-credential RCE, Pre-authentication root RCE in atvise SCADA 3.13.0 (atvise GmbH / Bachmann Visutec)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0053",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/5",
            "automated": true,
            "contentSha256": "5f35e4b7a988f79d9ca7b4948960b18fa7e165d1082fce2c8b33313be9737c3c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-03T03:35:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:37:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0053"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47867",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T16:47:13.658945Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-22T16:52:40.820Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Winpakpro",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alan Mondragon"
        }
      ],
      "datePublic": "2021-03-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "WIN-PACK PRO4.8 contains an unquoted service path vulnerability in the ScheduleService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in \u0027C:\\Program Files \u003cx86\u003e\\WINPAKPRO\\ScheduleService Service.exe\u0027 to inject malicious code that would execute during service startup."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-428",
              "description": "Unquoted Search Path or Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-21T17:27:45.271Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "ExploitDB-49691",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/49691"
        },
        {
          "name": "Honeywell Product Webpage",
          "tags": [
            "product"
          ],
          "url": "https://www.security.honeywell.com/product-repository/winpak"
        },
        {
          "name": "VulnCheck Advisory: WIN-PACK PRO 4.8 - \u0027ScheduleService\u0027 Unquoted Service Path",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/win-pack-pro-scheduleservice-unquoted-service-path"
        }
      ],
      "title": "WIN-PACK PRO 4.8 - \u0027ScheduleService\u0027 Unquoted Service Path",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-47867",
    "datePublished": "2026-01-21T17:27:45.271Z",
    "dateReserved": "2026-01-18T12:35:05.170Z",
    "dateUpdated": "2026-01-22T16:52:40.820Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47867",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T16:47:13.658945Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-22T16:52:40.820Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Winpakpro",
          "vendor": "Security",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alan Mondragon"
        }
      ],
      "datePublic": "2021-03-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "WIN-PACK PRO4.8 contains an unquoted service path vulnerability in the ScheduleService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in \u0027C:\\Program Files \u003cx86\u003e\\WINPAKPRO\\ScheduleService Service.exe\u0027 to inject malicious code that would execute during service startup."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-428",
              "description": "Unquoted Search Path or Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-21T17:27:45.271Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "ExploitDB-49691",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/49691"
        },
        {
          "name": "Honeywell Product Webpage",
          "tags": [
            "product"
          ],
          "url": "https://www.security.honeywell.com/product-repository/winpak"
        },
        {
          "name": "VulnCheck Advisory: WIN-PACK PRO 4.8 - \u0027ScheduleService\u0027 Unquoted Service Path",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/win-pack-pro-scheduleservice-unquoted-service-path"
        }
      ],
      "title": "WIN-PACK PRO 4.8 - \u0027ScheduleService\u0027 Unquoted Service Path",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2021-47867",
    "datePublished": "2026-01-21T17:27:45.271Z",
    "dateReserved": "2026-01-18T12:35:05.170Z",
    "dateUpdated": "2026-01-22T16:52:40.820Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}