Sangoma Switchvox CVE-2026-9586 /pa SQLi RCE

Exploits CVE-2026-9586 via the unauthenticated /pa XML phone-notification endpoint. Injects stacked PostgreSQL into the PhoneIP field and uses COPY ... TO PROGRAM to run a shell command as the database superuser. !/usr/bin/env python3 -- coding: utf-8 -- """Sangoma Switchvox CVE-2026-9586...

geoserver-0day-rce

GeoServer SQL Injection to RCE Zero-Day CVE: None yet?...

CVE-2026-46624 Twenty: SQL Injection via the timeZone field

Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution RCE vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the...

CVE-2026-46624

Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution RCE vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the...

CVE-2026-46624: Improper Neutralization of Special Elements used in an OS Command

Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution RCE vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the...