Threat Intelligence Database

CVE-2026-7073 is a medium severity SQL injection vulnerability in itsourcecode Construction Management System version 1.0. The flaw exists in the /execute.php file where manipulation of the 'code' argument allows remote attackers to perform SQL injection. The vulnerability is publicly known and an exploit has been published, but no official patch or remediation guidance is currently available from the vendor.

CVE-2025-63414 is a critical path traversal vulnerability in the Allsky WebUI that allows unauthenticated remote attackers to execute arbitrary commands on the underlying operating system via a crafted HTTP request to the /html/execute.php endpoint. This leads to full remote code execution without requiring authentication or user interaction. The vulnerability stems from improper input validation in the id parameter, enabling attackers to traverse directories and inject OS commands. With a CVSS score of 10.0, this flaw impacts confidentiality, integrity, and availability severely. Although no known exploits are currently reported in the wild, the ease of exploitation and the critical impact make it a significant threat. European organizations using Allsky WebUI are at risk, especially those in countries with higher adoption of this software or strategic targets for cyberattacks. Immediate mitigation involves restricting access to the vulnerable endpoint, applying patches once available, and implementing network-level protections. Countries like Germany, France, and the UK are likely most affected due to their technological infrastructure and usage patterns.

CriticalVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-63414

Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/codegit/traits/execute.php` allows argument injection, leading to arbitrary command execution. Atheos administrators and users of vulnerable versions are at risk of data breaches or server compromise. Version 6.0.4 introduces a `Common::safe_execute` function that sanitizes all arguments using `escapeshellarg()` prior to execution and migrated all components potentially vulnerable to similar exploits to use this new templated execution system.

CriticalVulnerabilityGermanyFranceNetherlands+5#cve#cve-2025-49008#cwe-78