CVE-2026-115994 is an authorization bypass vulnerability in CervantesSec cervantes version v1.3-beta. It allows an attacker with limited privileges to modify or delete targets belonging to other projects without proper authorization. This compromises the integrity of penetration testing scopes, results, and associated security reports. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

This vulnerability (CVE-2026-115994) in CervantesSec cervantes v1.3-beta involves Broken Object Level Authorization (BOLA) that permits an attacker to tamper with targets across different projects. Specifically, an attacker can modify or delete targets that do not belong to their authorized project, thereby affecting the accuracy and trustworthiness of penetration testing data and reports. The CVSS 3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

CVE Database V5

CVE-2026-115994 is an authorization bypass vulnerability in CervantesSec cervantes version v1.3-beta. It allows an attacker with limited privileges to modify or delete targets belonging to other projects without proper authorization. This compromises the integrity of penetration testing scopes, resu

CVE-2026-115994: CWE-639 - Authorization Bypass Through User-Controlled Key in CervantesSec cervantes

CVE-2026-114194 is a reflected cross-site scripting (XSS) vulnerability in the Igor Funa Ad Inserter plugin. It affects versions from initial releases up to 2.8.18. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute malicious scripts in the context of a user's browser session. The CVSS score is 6.5, indicating a medium severity level.

The vulnerability identified as CVE-2026-114194 affects the Igor Funa Ad Inserter plugin versions prior to 2.8.19. It is a reflected cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that can be executed in the victim's browser, potentially leading to information disclosure, session hijacking, or other impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).

CVE-2026-114194 is a reflected cross-site scripting (XSS) vulnerability in the Igor Funa Ad Inserter plugin. It affects versions from initial releases up to 2.8.18. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute malic

CVE-2026-114194: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Igor Funa Ad Inserter

A URL identified as an attacker callback or command-and-control (C2) endpoint was observed in the wild by OffSeq Mirage honeypot sensors on July 28, 2026. The URL was seen four times during attacker activity and is associated with technique T1657. The attacker infrastructure was located in Switzerland (CH). This indicator is intended for blocking and monitoring to detect potential malicious traffic.

OffSeq Mirage honeypot sensors detected a suspicious URL used as an out-of-band callback or command-and-control endpoint during attacker activity on July 28, 2026. The URL was observed four times and is linked to the ATT&CK technique T1657, which involves command and control over network channels. The attacker infrastructure was identified as originating from Switzerland. This URL serves as an indicator of compromise (IOC) for defenders to block and monitor in proxy, web, or WAF logs.

OffSeq Mirage

A URL identified as an attacker callback or command-and-control (C2) endpoint was observed in the wild by OffSeq Mirage honeypot sensors on July 28, 2026. The URL was seen four times during attacker activity and is associated with technique T1657. The attacker infrastructure was located in Switzerla

OffSeq Mirage — attacker URL

Attacker url observed in the wild: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa… (OffSeq Mirage)

Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) have a vulnerability involving hard-coded credentials in an undocumented account named "zyfwp" with an unchangeable password. This vulnerability allows unauthorized access due to the presence of fixed credentials that cannot be changed by users.

CVE-2020-29583 identifies a use of hard-coded credentials vulnerability affecting multiple Zyxel products, including firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500). The vulnerability stems from an undocumented account "zyfwp" that has a hard-coded password which cannot be altered. This security flaw can be exploited to gain unauthorized access to affected devices. The vulnerability has been exploited in the wild, indicating active threat actor usage.

CISA KEV

Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) have a vulnerability involving hard-coded credentials in an undocumented account named "zyfwp" with an unchangeable password. This vulnerability allows unauthorized access due to the presence of fixed credentials that cannot be 

https://nvd.nist.gov/vuln/detail/CVE-2020-29583

CISA KEV — CVE-2020-29583

CVE-2020-29583: Zyxel Multiple Products Use of Hard-Coded Credentials Vulnerability

CVE-2019-8394 is a high-severity vulnerability in Zoho ManageEngine ServiceDesk Plus (SDP) that allows remote attackers to upload files via the login page customization feature. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Zoho ManageEngine ServiceDesk Plus (SDP) contains a file upload vulnerability (CWE-434) that permits remote users to upload files through the login page customization functionality. The vulnerability is unspecified in technical detail but is known to be exploited in the wild. No vendor advisory or patch information is available in the provided data.

Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.

https://nvd.nist.gov/vuln/detail/CVE-2019-8394

CISA KEV — CVE-2019-8394

CVE-2019-8394: Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability

Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

CVE-2019-2725: Oracle WebLogic Server, Injection

Description

Weaknesses

Community Reviews

Actions

External Links

Need more coverage?

Latest Threats

Check if your credentials are on the dark web

Lead Pen Test Professional