Overzicht van binnengekomen advisories.
2179 resultaten gevonden
A critical unauthenticated Local File Inclusion (LFI) vulnerability has been identified in the WP Cafe Pro WordPress plugin affecting versions prior to 3.0.15. The vulnerability allows unauthenticated attackers to include local files on the server, potentially leading to sensitive information disclosure, code execution, or full system compromise. No authentication is required to exploit this vulnerability, significantly increasing its risk. The issue has been assigned CVE-2026-66587 and is documented in both the NVD and Patchstack databases. Users of WP Cafe Pro are strongly advised to update to version 3.0.15 or later to remediate the vulnerability. The unauthenticated nature of the exploit makes it particularly dangerous for sites running outdated versions of the plugin.
Bekijk origineel advisory →CVE-2026-78211 affects 4MOSAn GCB Doctor, a product developed by 4MOSAn Security Technology. The vulnerability is an OS Command Injection flaw that can be exploited by unauthenticated remote attackers. Attackers can inject malicious commands through an unremoved ADOdb test page parameter left in the application. Successful exploitation allows arbitrary system command execution on the affected server. No authentication is required, making this vulnerability particularly dangerous and easily exploitable. The vulnerability was reported via Taiwan's TWCERT/CC advisory system. The issue stems from improper removal of a database library test page exposed in the production environment. This type of leftover debug/test functionality represents a significant security risk. The criticality is rated High due to the unauthenticated remote code execution potential.
Bekijk origineel advisory →A security vulnerability has been identified in EFM ipTIME T24000M firmware versions up to 14.20.0. The flaw exists in the function httpcon_check_session_url within the Session Validation Handler component. Exploitation of this vulnerability leads to improper authentication, potentially allowing unauthorized access. The attack vector is remote, requiring no physical access to the device. A public exploit has already been disclosed and is available for use. The vendor was notified prior to public disclosure but did not respond. This poses a significant risk to network infrastructure relying on this hardware. No patch or mitigation from the vendor has been confirmed.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=confirm_order, where manipulation of the 'ID' argument leads to SQL injection. The attack can be executed remotely without requiring physical access. A public exploit has been released, increasing the risk of active exploitation. The vulnerability affects the admin panel's order confirmation functionality. No authentication bypass details are specified, but the remote exploitability and public exploit availability make this a significant threat. Organizations using this software should apply patches or mitigations immediately.
Bekijk origineel advisory →A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3 due to improper validation of the lobby data field 'kick_num'. The function processes kicked player IDs without verifying that 'kick_num' stays within expected bounds, allowing writes beyond a 16-entry buffer sized for the maximum player count. Overflow data spills into adjacent heap memory containing Steam callback handler structures used for lobby data updates and messaging. An attacker can overwrite function pointers and callback argument values within these structures by supplying a crafted oversized 'kick_num' and corresponding 'kicked_id_%i' fields. This enables control-flow hijacking and potentially arbitrary code execution within the game process. The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and is referenced by CERT/CC advisory VU#728712. Exploitation requires the ability to supply malicious lobby data to a target player in an online session.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the file /fos/admin/ajax.php?action=save_user, where manipulation of the Username argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring physical access to the target system. A public exploit has already been released, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-78197 and is tracked in VulDB as vuln/394574. No patch or mitigation details are currently mentioned in the article. The public availability of the exploit makes this a higher-risk issue for any organization running this software.
Bekijk origineel advisory →Multiple DrayTek VigorAP models are affected by a critical command injection vulnerability identified as CVE-2026-71914. The flaw resides in the dray_apm component and is triggered by insufficient validation of UDP message content following the START_SPEED_TEST command. A remote, unauthenticated attacker can send a specially crafted UDP message to exploit this vulnerability. Successful exploitation allows arbitrary command execution with root privileges on the affected device. The vulnerability requires no authentication, making it particularly dangerous for internet-exposed devices. DrayTek has published a security advisory acknowledging the issue and providing guidance. VulnCheck has also published an advisory detailing the pre-authentication nature of the exploit. This vulnerability poses a significant risk to network infrastructure environments where VigorAP access points are deployed. Administrators are strongly advised to apply patches or mitigations as soon as they become available.
Bekijk origineel advisory →A vulnerability has been identified in itsourcecode Payroll System version 1.0 affecting the save_settings function within admin_class.php. The flaw allows attackers to manipulate the 'img' argument to perform unrestricted file uploads, potentially enabling remote code execution. The attack can be carried out remotely without physical access to the target system. A public exploit has been disclosed, increasing the risk of active exploitation. The vulnerability is tracked as CVE-2026-78202 and has been reported via GitHub and VulDB. The affected product is a payroll management web application commonly used by small organizations. Unrestricted file upload vulnerabilities are particularly dangerous as they can allow attackers to upload malicious scripts. No patch information is currently noted in the article.
Bekijk origineel advisory →CVE-2026-76836 describes a privilege escalation and remote code execution vulnerability in AzuraCast, an open-source web radio management suite. The flaw exists because the PUT /api/station/{station_id}/profile/edit endpoint deserializes backend_config fields annotated with GROUP_GENERAL while only requiring StationPermissions::Profile, bypassing the stricter StationPermissions::Broadcasting required by the dedicated Liquidsoap config endpoint. This allows a station manager with only profile permissions to write arbitrary Liquidsoap custom configuration fields such as custom_config_top, custom_config, and others. ConfigWriter::writeCustomConfigurationSection() emits these values verbatim into generated .liq scripts, enabling injection of Liquidsoap process.run() or process.exec() calls that execute OS commands. The attack is triggered automatically when needs_restart is set, causing the built-in sync task to restart the backend and execute the injected commands. This represents a broken access control issue compounded by unsanitized script generation leading to OS-level command execution.
Bekijk origineel advisory →CVE-2026-75899 affects fast-uri, a URI parser for Node.js, where percent-encoded hostnames are decoded twice during parsing and authority recomposition. This double-decoding allows doubly encoded input to resolve to a different network destination, such as a loopback address, violating RFC 3986 section 2.4. The flaw enables server-side request forgery (SSRF) and host-policy bypass in applications that normalize or resolve untrusted HTTP-family URIs before routing or validation. It is an incomplete fix variant of CVE-2026-6322. Affected versions span 2.4.1 to 2.4.4, 3.1.2 to 3.1.5, and 4.0.0 to 4.1.2. Patches are available in versions 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes only once and preserve encoded percent signs. Users are strongly advised to upgrade immediately.
Bekijk origineel advisory →CVE-2026-75975 affects fast-uri, a URI parser for Node.js, where the custom parser for bracketed IPv6 literals fails to validate the complete IPv6 grammar. Invalid trailing text in an authority component is silently discarded, causing malformed attacker-controlled hosts to be resolved as different valid IPv6 destinations. This enables server-side request forgery (SSRF) and address-policy bypass by redirecting requests to loopback or private-range IPv6 addresses. No error is set on the parsed result, making the rewrite undetectable via error field checks. Applications normalizing untrusted URLs for outbound requests, redirects, proxy routing, or policy enforcement are at risk. Affected versions include 2.3.1–2.4.4, 3.0.0–3.1.5, and 4.0.0–4.1.2. Patches are available in versions 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users are strongly advised to upgrade immediately.
Bekijk origineel advisory →A stack-based buffer overflow vulnerability has been identified in UTT HiPER 1250GW devices running firmware up to version 3.2.7-210907-180535. The vulnerability resides in the strcpy function within the /goform/aspRemoteApConfTempSend endpoint of the HTTP Request Handler component. An attacker can exploit this by manipulating the 'Profile' argument to trigger a stack-based buffer overflow. The attack can be performed remotely without requiring physical access to the device. A public exploit is already available, increasing the risk of active exploitation in the wild. The vulnerability is classified as high severity given its remote exploitability and public exploit availability. Network administrators using affected UTT HiPER 1250GW devices should apply patches or mitigations immediately.
Bekijk origineel advisory →A missing authentication vulnerability was identified in the-momentum open-wearables up to version 0.6.2. The flaw exists in the redeem_invitation_code function within the file backend/app/api/routes/v1/user_invitation_code.py at the Public Invitation-Code Redemption Endpoint. By manipulating the 'code' argument, an unauthenticated remote attacker can exploit this endpoint without proper authentication checks. The vulnerability allows remote exploitation, potentially enabling unauthorized access or abuse of the invitation system. The project was disclosed the issue via an issue report but has not responded or patched the vulnerability as of the article date. No CVSSv3 score or patch is currently available. The lack of vendor response increases the risk of exploitation in the wild.
Bekijk origineel advisory →exceljs-hardened versions before 5.0.0 contain a prototype pollution vulnerability in the deepMerge helper function. The vulnerability arises because the helper fails to reject dangerous keys such as __proto__, constructor, or prototype when merging note objects. Attackers can exploit this by assigning parsed JSON with a malicious __proto__ property to cell notes. This allows modification of Object.prototype, which affects all plain objects created during the process. The vulnerability is reachable via note serialization in spreadsheet processing. A fix is available in exceljs-hardened version 5.0.0 and above. The issue originates in the under-dash.js utility file in the upstream exceljs library. A GitHub Security Advisory (GHSA-qwr4-7h29-chpf) has been published for this vulnerability. VulnCheck has also documented this issue in their advisories.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in itsourcecode Sales and Inventory System version 1.0. The vulnerability exists in the file /pages/processlogin.php, where manipulation of the 'User' argument allows an attacker to perform SQL injection attacks. The attack can be initiated remotely without requiring physical access to the target system. The exploit has been publicly disclosed and is available for use by malicious actors. This vulnerability poses a significant risk as it could allow unauthorized access to the underlying database. The affected product is a widely used open-source sales and inventory management system. No patch or mitigation details are currently noted in the article.
Bekijk origineel advisory →exceljs-hardened versions before 5.0.0 contain a CSV formula injection vulnerability due to failure to neutralize leading special characters (equals, plus, minus, at signs) in cell values written to CSV output. Attackers who can influence exported cell values can inject malicious formulas that execute when the CSV file is opened in a spreadsheet application such as Microsoft Excel or LibreOffice Calc. This type of attack, also known as CSV injection or formula injection, can lead to data exfiltration or other malicious actions. The vulnerability affects the CSV export functionality in the exceljs-hardened library. Users are advised to upgrade to version 5.0.0 or later to mitigate the risk. The issue is tracked as CVE-2026-78209 and has been assigned a high criticality rating.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in itsourcecode Online Clinic Management System version 1.0. The vulnerability exists in the file success/login.php within the Admin Login component. An attacker can manipulate the Username argument to perform SQL injection attacks. The vulnerability is remotely exploitable, meaning no local access is required. A public exploit has already been disclosed and may be actively used by attackers. This poses a significant risk to healthcare management systems running this software. The vulnerability has been catalogued as CVE-2026-78246 and tracked across multiple security databases including NVD and VulDB.
Bekijk origineel advisory →Multiple DrayTek VigorSwitch models are affected by a critical pre-authentication command injection vulnerability tracked as CVE-2026-71921. The flaw resides in the setget.cgi interface and is caused by insufficient input filtering of the 'pass' field prior to command execution. A remote, unauthenticated attacker can exploit this vulnerability by sending crafted input to execute arbitrary operating system commands with root privileges. No authentication is required to trigger the vulnerability, making it particularly dangerous for internet-exposed devices. DrayTek has published a security advisory acknowledging the issue. The vulnerability impacts the VigorSwitch product series and poses significant risk to network infrastructure environments. Organizations using affected DrayTek VigorSwitch models are advised to apply patches or mitigations immediately.
Bekijk origineel advisory →CVE-2026-76172 affects fast-uri, a URI parser for Node.js, across versions 2.3.1–2.4.4, 3.0.0–3.1.5, and 4.0.0–4.1.2. The vulnerability stems from a legacy decoding pass over the URI scheme component that decodes percent-encoded characters without re-escaping them, causing a mismatch between parsed and serialized output. An attacker can craft a URI with percent-encoded slashes in the scheme to make the parser report no authority/host, while serialization emits an attacker-controlled network-path reference with an arbitrary host. This discrepancy enables off-site redirects, server-side request forgery (SSRF), and address-policy bypasses in applications that rely on the parsed host for security decisions. Additionally, the legacy decoder expands non-standard escape forms, allowing bypass of upstream filters, and control characters in the scheme can be emitted as raw CRLF sequences. Fixed versions 2.4.5, 3.1.6, and 4.1.3 reject schemes that are invalid after decoding. Users are strongly advised to upgrade immediately.
Bekijk origineel advisory →Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability in netis.cgi. Unauthenticated remote attackers can exploit the vulnerability by supplying an oversized destHost parameter to the ipFilterList=mod action. The root cause is widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers without prior authentication checks. Successful exploitation allows overwriting saved stack state and achieving remote code execution. The impact is critical as code executes with root privileges due to the Boa web server running the CGI environment as root. No authentication is required to trigger the vulnerability, making it trivially exploitable remotely. The vulnerability affects all firmware versions up to and including V3.0.0.3327. A proof-of-concept and detailed write-up have been published publicly, increasing exploitation risk.
Bekijk origineel advisory →