CVE-2026-33534 EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation

EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery SSRF vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation e.g.,...

PT-2026-32508

EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery SSRF vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation e.g.,...

ABB Cylon FLXeon 9.3.4 Session Persistence Vulnerability

ABB Cylon FLXeon version 9.3.4 has an issue where user sessions on controllers remain active for up to seven days, even after a client-side logout. ABB Cylon FLXeon 9.3.4 Session Persistence Vulnerability Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series FB...

ABB Cylon FLXeon 9.3.4 Insecure Backup Sensitive Data Exposure

Summary BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...

ABB Cylon FLXeon 9.3.4 app.js Insecure CORS Configuration

ABB Cylon FLXeon version 9.3.4 suffers from an insecure CORS configuration. !-- ABB Cylon FLXeon 9.3.4 app.js Insecure CORS Configuration Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series FBXi Series, FBTi Series, FBVi Series CBX Series FLX Series CBT Serie...

ABB Cylon FLXeon 9.3.4 (app.js) Insecure CORS Configuration

Summary BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...

ABB Cylon FLXeon 9.3.4 users.js Authenticated Root Remote Code Execution

ABB Cylon FLXeon version 9.3.4 is vulnerable to authenticated remote root code execution via the /api/users/password endpoint. An attacker with valid credentials can inject arbitrary system commands by manipulating the newPassword PUT parameter. The issue arises in users.js, where the new passwor...

ABB Cylon FLXeon 9.3.4 cmds.js Authenticated Root Remote Code Execution Exploit

ABB Cylon FLXeon version 9.3.4 is vulnerable to authenticated root command execution via the cmds API. An authenticated attacker can execute arbitrary system commands with root privileges. !/usr/bin/env python3 ABB Cylon FLXeon 9.3.4 cmds.js Authenticated Root Remote Code Execution Vendor: ABB Lt...

ABB Cylon FLXeon 9.3.4 upload.js Authenticated Root Remote Code Execution

ABB Cylon FLXeon version 9.3.4 is vulnerable to an authenticated root command injection. An attacker can exploit the Backup-Restore feature via the /api/upload endpoint to execute arbitrary system commands as root. The issue arises due to improper input validation in upload.js, where user-supplie...

ABB FLXeon 日志信息泄露漏洞

The ABB FLXeon is a series of controllers from ABB Switzerland. ABB FLXeon version 9.3.4 and prior versions suffer from a log information disclosure vulnerability that stems from the application's inadequate protection of sensitive information and can be exploited by an attacker to obtain sensiti...

CVE-2024-48841

CVE-2024-48841 affects ABB Cylon FLXeon 9.3.4 and earlier. Multiple authenticated and unauthenticated remote code execution vectors are reported (examples: /api/users/password, /api/cert, /api/timeConfig, /api/cmds.js, /api/upload). The root cause across endpoints is improper input validation lea...

ABB FLXeon 安全漏洞

ABB FLXeon is a series of controllers from ABB Switzerland. A security vulnerability exists in ABB FLXeon version 9.3.4 and prior versions, which originates from a vulnerability that allows an attacker to execute arbitrary code and elevate privileges via network access...

Drupal 代码问题漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Monster Menus prior to version 9.3.4, versions 9.4.0 through 9.4.2, which stems from the inclusion of an untrusted data deserialization vulnerability...

Drupal Monster Menus module < 9.3.4,9.4.0-9.4.1 - Unauthenticated Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE vulnerability discovered by Drew Webber in WordPress Module Monster Menus versions 9.3.4,9.4.0-9.4.1...

PT-2025-2103 · Drupal · Drupal Monster Menus

Name of the Vulnerable Software and Affected Versions: Drupal Monster Menus versions 0.0.0 through 9.3.3 Drupal Monster Menus versions 9.4.0 through 9.4.1 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This can potentially enable a remot...

PT-2025-2806 · Flxeon · Flxeon

Name of the Vulnerable Software and Affected Versions: FLXEON versions through = 9.3.4 Description: The issue is related to a lack of origin validation in WebSockets, which allows unauthorized HTTPS requests due to insufficient session management. This can be exploited by a remote attacker to...

CVE-2024-8661 Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block

Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6...

CVE-2024-29011

Use of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlier versions...

CVE-2024-29011

SonicWall GMS Virtual Appliance (Windows) ECM endpoint is affected by CVE-2024-29011 due to a hard-coded credential in the ECMClientAuthenticator class, enabling authentication bypass. Affected: GMS versions 9.3.4 and earlier. Impact: remote authentication bypass; no public exploit details provid...

CVE-2024-29010

The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity XXE injection, potentially resulting in the disclosure of sensitive information. This issue affects GMS: 9.3.4 and earlier versions...