An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF into the emailAddress inserted into an SMTP envelope command by a JSON SOAP request. After a successful preliminary POP3 or IMAP login, Zimbra sends the injected commands to the selected SMTP service. If that service accepts the pipelined transaction, the attacker can submit mail with attacker-selected recipients, headers and body content without victim interaction. The vulnerable command-construction path is present in ZCS 10.1.16 and 10.1.20.
baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain a deserialization vulnerability in the widget-area entity. This flaw allows an administrator or an attacker with widget-write capability to store malicious serialized objects via the admin JSON API. These objects are deserialized without class restrictions, enabling remote code execution as the web-server user upon unauthenticated page access after payload storage. The vulnerability has been patched in versions 5.3.2 and 5.4.2.
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2.
A PHP vulnerability was recently disclosed with coordinated patches released by PHP.net and many vendors. No reliable public exploit code is currently available, though some firms claim to have working exploits. Cloudflare and Amazon report many exploit attempts, but it is unclear if these are effective. Applying the official patches is the recommended defense. Workarounds and web application firewall rules may provide limited temporary protection. Embedded devices and appliances running vulnerable PHP versions are a concern due to patching difficulties and should be isolated. The situation highlights the importance of timely patching and preparedness for future similar vulnerabilities.
baserCMS versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2 contain a path traversal vulnerability in the optional BcThemeFile plugin's Admin API. The vulnerability arises because encoded path traversal sequences are decoded after validation, allowing an authenticated administrator to write PHP files outside the intended theme directory, such as into the webroot, and execute them. Exploitation requires an administrator session, the non-default plugin enabled, and a same-origin Origin header. The issue has been patched in versions 5.3.2 and 5.4.2.
NetBox MCP Server versions prior to 1.2.1, when configured to use HTTP transport, lack authentication on the HTTP endpoint. This allows any client with network access to the MCP server port to establish a valid session and gain full read-only access to all four NetBox tools without requiring tokens or credentials. The vulnerability has been addressed in version 1.2.1.
baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain an SQL injection vulnerability in the Admin and Api/Admin prefixes. Authenticated users with admin panel access can inject SQL fragments via request query parameters passed directly to the ORM, potentially allowing arbitrary SQL execution including reading password hashes. The vulnerability was patched in versions 5.3.2 and 5.4.2.
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata that causes entire session resume or entire checkpoint rewind to write attacker-controlled transcript data outside of the expected session directory. The issue occurs because checkpoint metadata is fetched from the remote entire/checkpoints/v1 branch and the SessionID field was used to construct filesystem paths without validation in the restore path. A malicious SessionID containing absolute paths or path traversal sequences could cause arbitrary files on the victim’s machine to be overwritten. This issue has been patched in version 0.7.7.
A missing authorization vulnerability exists in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9 on Android. This flaw allows a local application without any permissions to invoke privileged operations such as factory reset with user-data wipe, device shutdown, clock/timezone changes, and firmware update hand-off. The root cause is that the onTransact() method does not perform any caller-identity or permission checks.
baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 have a vulnerability in the public API endpoint for mail message submissions. The API endpoint does not enforce the form's captcha verification, allowing unauthenticated attackers to automate submissions without solving the captcha challenge. This can lead to spam in administrator inboxes, attacker-influenced auto-replies, and accumulation of mail message records in the database. The issue has been patched in versions 5.3.2 and 5.4.2.
baserCMS versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2 contain an improper input validation vulnerability in public mail forms. An unauthenticated visitor can supply a comma-separated list of email addresses in the email field, causing a single auto-reply to be sent to multiple third parties. This occurs when server-side VALID_EMAIL validation is not enabled on newly created forms with email-type fields. The bundled contact form is not affected as it enables VALID_EMAIL validation by default. The issue has been fixed in versions 5.3.2 and 5.4.2.
An OS command injection vulnerability exists in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9 on Android. A local unprivileged process can exploit this by writing a crafted line to the Android log (logcat), which the helper reads and executes with root privileges. This allows arbitrary command execution as root.
A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without restricting the configuration path. An attacker can supply a configuration that retains root privileges and disables the chroot. Include directives expose root-readable file contents through parser errors, while an attacker-selected logfile path creates a root-owned file or appends Unbound log records to an existing file. This can disclose password hashes and private keys and corrupt privileged configuration files, preventing affected services from starting with the modified configuration. The affected configuration is present in ZCS 10.1.16 and 10.1.21 dnscache packages.
baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decide what each user group may reach. When that file is absent it writes a wildcard allow rule instead: `url` `/baser/<prefix>/<plugin>/*`, `method` `*`, `auth` true, for every non-admin group. BcCustomContent has no such file in any release. After an administrator installs it, the default `operators` group can store and execute arbitrary PHP under the document root. Versions 5.3.2 and 5.4.2 patch the issue.
CVE-2026-114354 is a high-severity vulnerability in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9. It involves missing authorization in the native binder service 'android.dji.server' (transaction code 1018), allowing a local application without permissions to execute arbitrary OS commands as root. This occurs because the handler passes a caller-supplied string to the root-privileged 'assistant' daemon's system() call without verifying caller identity or permissions.
A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. An attacker can select a zimbra-controlled daemon_directory in the Postfix configuration and invoke postfix set-permissions, causing Postfix to execute the attacker's post-install program as root. The Postfix configuration directory is also writable by zimbra, so restricting postconf alone does not remove the execution path. Exploitation requires local command execution as zimbra on an MTA node. ZCS 10.1.16 and 10.1.21 are affected.
Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts JVM arguments that are not adequately restricted. An attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root. Exploitation requires local command execution as zimbra on a mailbox server and interrupts mailboxd during the malicious restart. ZCS 10.1.16 and 10.1.21 are affected.
A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the proxy allowlist of the default class of service. If a signed-in user in that class opens a crafted /service/proxy URL, Zimbra serves attacker-controlled HTML under its own origin. The resulting JavaScript can read mailbox data and perform authenticated actions as the victim. Exploitation requires a delegated-administrator account and access to the admin SOAP service; the browser compromise additionally requires the victim to open the crafted URL. ZCS 10.1.16 and 10.1.20 are affected.