MDaemon-Advisories

MDaemon 安全公告 MDaemon 公告： CVE-2021-27180（反射型 XSS） CVE-2021-27181（CSRF Token 固定） CVE-2021-27182（Iframe 注入） CVE-2021-27183（远程代码执行） 这些漏洞已于 2021 年 1 月修复，并已作为 CVE 公开。它们可以组合利用，通过电子邮件消息实现远程代码执行/帐户接管（需要用户交互）。 时间线： 2020 年 12 月 15 日：向供应商提交漏洞报告 2021 年 1 月 12 日：发布补丁 补丁说明：...

CVE-2024-9464

CVE-2024-9464: Palo Alto Expedition 认证命令注入 利用CVE-2024-9464在易受攻击设备上的概念验证。此脚本链式使用CVE-2024-5910的管理员重置，实现"未认证"的任意命令执行。 博客文章 根本原因和入侵指标此处： https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/ 用法 % python3 CVE-2024-9464.py -h usage: CVE-2024-9464.py -h -u URL -c...

chyrp-lite-rce-poc

chyrp-lite-rce-poc CVE-2026-53767 + CVE-2026-53768 - RCE autenticado en Chyrp Lite ≤ 2026.01 "Iriomote" Ataque encadenado: bypass de la lista negra de uploadspath CVE-2026-53768 + falta de validación de la extensión de archivo en adminupdateupload CVE-2026-53767 → Ejecución remota de código como...

CVE-2024-2961

Buddyforms 2.7.7 CNEXT RCE 利用 CVE-2024-2961 和 CVE-2023–26326 实现远程代码执行（RCE） 用法 git-clone https://github.com/suce0155/CVE-2024-2961buddyforms2.7.7 pip install -r requirements.txt python3 buddyforms2.7.7cnextexploit.py http://site/wp-admin/admin-ajax.php ip port 分析与技术细节 查看我的 博客文章 POC...

fusionpbx_rce_vulnerability

Preludio Este simple código intenta completar la implementación de la vulnerabilidad encadenada presentada por Dustin Cobb en RCE mediante Caller ID – Múltiples vulnerabilidades en FusionPBX. RCE Pasos de reproducción 1. Abra la pantalla vulnerable del operador en un navegador web, ubicada en est...

CVE-2026-13187

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation...

CVE-2026-13188

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation...

EUVD-2026-47693

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation...

CVE-2026-13187 DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation...

EUVD-2026-47692

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation...

CVE-2026-13188: Insufficient Verification of Data Authenticity

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation...

PT-2026-63402

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description Request parameters within the 'DialogHandler' may be tampered with, which could allow an attacker to alter the server-side behavior of dialogs and facilitate chained exploitation...

CVE-2026-13187: Use of Externally-Controlled Input to Select Classes or Code

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation...

PT-2026-63401

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description Input provided to the DialogHandler provider type can be tampered with, which may allow an attacker to alter how dialogs are processed and potentially enable chained exploitation...

CVE-2026-40552

mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remot...

BinSoft mpGabinet 安全漏洞

BinSoft mpGabinet is a medical clinic management system developed by the Polish company BinSoft. Versions of BinSoft mpGabinet prior to December 23, 2021, contained security vulnerabilities. These vulnerabilities were due to issues with remote command execution, which could allow authorized users...

CVE-2025-8306 Improper Access Control in Asseco Infomedica Plus

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts including main administrator due to lack of granularity in access control. Chained...

VICIdial Authenticated Remote Code Execution Exploit

metasploit.com This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VICIdial Authenticated Remote Code Execution', 'Description' = %q An attacker with authenticated access to VICIdial as an "agent"...

Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082

October 1, 2022 update – Added information about Exploit:Script/ExchgProxyRequest.A, Microsoft Defender AV’s robust detection for exploit behavior related to this threat. We also removed a section on MFA as a mitigation, which was included in a prior version of this blog as standard guidance...