Threats tagged 'exploit'

PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

Open eClass 3.15 - RCE

Keycloak 26.7.2 - Unauthenticated Account Takeover

ProSoft RLX-IFH24E version 2.2.44 contains a vulnerability where an unsigned firmware upgrade package is executed with root privileges.

Parasoft Continuous Testing Platform version 10.7.5 is affected by a JSP command execution vulnerability.

An exploit targeting Exasol Database version 7.1.30 enables command execution. Limited technical details are available, and no affected versions or patch information are provided.

An authenticated command injection vulnerability exists in Edimax BR-6478AC firmware version 2.20. This vulnerability allows an attacker with valid credentials to execute arbitrary commands on the affected device.

Automotive Shop Management System version 1.0 is affected by a SQL injection vulnerability. This vulnerability allows an attacker to manipulate SQL queries executed by the application, potentially leading to unauthorized data access or modification.

Synametrics Syncrify version 6.2 is associated with a command execution security issue. Specific technical details and affected versions are not provided, and no patch information is available.

A code execution vulnerability has been reported in South River Technologies Titan MFT Server version 26.0.0. Limited technical details are available about the nature of the vulnerability or exploitation methods.

An SQL injection (SQLi) exploit targeting pizzafy version 1.0 has been identified. The exploit allows attackers to manipulate backend SQL queries, potentially leading to unauthorized data access or modification.

A cyberattack targeted French food stores by exploiting a previously known vulnerability in DanFoss refrigeration unit controllers. The same vulnerability had been exploited earlier in August against US Department of Defense commissaries. The affected stores had not applied patches or updates to the controllers, allowing attackers to disable refrigeration units.

This content describes a free, comprehensive, and open-source exploit development curriculum covering C programming, x86-64 assembly, reverse engineering, and advanced exploitation techniques. It is intended as an educational resource for beginners and security researchers to learn exploit development from the ground up. The curriculum is not a vulnerability or exploit itself but a learning tool.

A user on Reddit announced the creation of a Scripts Hub website for Roblox exploits, allowing users to post and share exploit scripts with moderator review. The announcement is a request for advice and reviews rather than a report of a specific vulnerability or active threat.

The 2026 Microsoft Digital Defense Report highlights trends in credential theft, phishing techniques including CAPTCHA-gated delivery, and rapid exploitation of container workloads. Credential theft remains a significant vector, with valid account intrusions often leading to further credential harvesting. Password attacks have declined, but session theft via phishing and token theft has increased. ClickFix-related malicious copy-and-paste intrusions surged significantly. Container workloads face exploitation attempts within hours of startup. A 2020 vulnerability (CVE-2020-1472) remains prevalent in detections. NTLM-related security cases have increased substantially in early 2026.

Krayin CRM version 2.2.4 is affected by an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability allows unauthorized attackers to bypass authentication and configure administrative settings via a specific API endpoint. Exploit code is publicly available demonstrating how to create an admin user without proper authorization.

A path traversal vulnerability affects WordPress version 7.0.2 and version 7.0.6, as well as versions prior to 7.1.2. This vulnerability could allow an attacker to access files outside the intended directory structure.

POMS oretnom23v1.0 contains SQL injection vulnerabilities that allow attackers to manipulate backend SQL queries, potentially leading to unauthorized data access or modification. No specific affected versions or patches are identified.

InvoicePlane version 1.7.1 contains a critical remote code execution (RCE) vulnerability that allows attackers to execute arbitrary code on affected systems remotely. No vendor advisory or patch information is currently available to confirm remediation status or mitigation steps.

SuiteCRM versions 8.10.1 and earlier, including 7.15.1, contain an authenticated Server-Side Request Forgery (SSRF) vulnerability. This flaw allows an authenticated user to cause the server to make HTTP requests to arbitrary locations.