Advantech WebAccess CrystalRpt unauth ASPX upload RCE

Unauthenticated CrystalRpt.aspx path traversal upload writes ASPX under IIS app root; invoke via ?c= for cmd.exe execution reverse shell via set payload. """Advantech WebAccess CrystalRpt.aspx unauthenticated upload → ASPX RCE.""" from future import annotations import posixpath import re import...

Docmosis Tornado storeTo file write cron RCE

Anonymous POST /api/render with storeTo=file:/etc/cron.d/... writes a cron line as root when the service runs with elevated privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Docmosis Tornado unauthenticated storeTo=file arbitrary write → cron root RCE.""" from future import annotations...

myDBR admin file editor save_file RCE

Challenge-response login default dba/dba then appsv/fileeditv.php savefile writes PHP under user/. !/usr/bin/env python3 -- coding: utf-8 -- """myDBR admin file editor savefile PHP webshell RCE.""" from future import annotations import hashlib import re from urllib.parse import quote, urlencode...

Scan2x ScanWebClient unauthenticated file upload RCE

Unauthenticated POST to /FileUploadHandler.ashx saves an .aspx under /ScannedFiles/; GET executes arbitrary commands via the cmd query parameter. """Scan2x ScanWebClient — unauthenticated FileUploadHandler upload to webshell RCE.""" from future import annotations import io import re import uuid...

Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx Leadin — Detect

Fingerprint / reachability check for Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx Leading to Code Execution in the IIS Worker Process !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx...

Xeams SMTP save-body cron root RCE

X-SMSAVEBODY4DEBUGGING writes arbitrary file; base64 body plants /etc/cron.d job running payload as root. """Xeams SMTP X-SMSAVEBODY4DEBUGGING Arbitrary File Write Cron Root RCE""" from future import annotations from kittysploit import import base64 import socket import sys import time import re...

Important: Red Hat Security Advisory: resteasy security update

An update for resteasy is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2026-12887

In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory...

CVE-2026-117566 EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

CVE-2026-117566

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

CVE-2026-117566

EasyImages versions 2.0 through 2.8.6 are vulnerable to an unauthenticated path traversal vulnerability in the app/down.php , app/thumb.php , and app/info.php components. The root cause is the improper limitation of pathnames, where attackers can supply ../ sequences in the dw , history , or img ...

EUVD-2026-110835

SDLimage through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMGLoadLBMIO in src/IMGlbm.c that skips bitplane count validation when HAM mode is set. Attackers can supply a crafted ILBM file with more than 8 HAM bitplanes to read past the colormap stack array,...

CVE-2026-117555 GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()

CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the loadbmp function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dxbytes, causing crashes or heap memory disclosure into the decod...

CVE-2026-117555 GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()

CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the loadbmp function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dxbytes, causing crashes or heap memory disclosure into the decod...

CVE-2026-117555

The GreycLab CImg library, version through 4.0.6 , is vulnerable to a heap out-of-bounds read within the _load_bmp() function of CImg.h. The root cause is an integer overflow in the row byte count, which can be triggered by providing a crafted BMP file with a large header width that wraps dx_byte...

CVE-2026-117555 GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()

CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the loadbmp function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dxbytes, causing crashes or heap memory disclosure into the decod...

CVE-2026-4337

Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files...

CVE-2026-106087

TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information...

flatpak security update

An update is available for flatpak. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Flatpak is a system for building, distributing, and running sandboxed deskto...