146 matches found
CVE-2018-1049-POC
This Python script is a custom reimplementation of the Metasploit module exploit for CVE-2018-1049, which targets VyOS Vyatta via a privilege escalation vulnerability in a Perl script misused through sudo. You need valid SSH credentials. You gain root via command injection in a sudo-permitted...
CVE-2026-59989
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...
GHSA-HRWP-4HH9-C8R8 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
Summary The Volt template compiler in Phalcon generates the PHP for the join filter by string-concatenating the filter's raw template-literal argument bytes with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is...
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
Summary The Volt template compiler in Phalcon generates the PHP for the join filter by string-concatenating the filter's raw template-literal argument bytes with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is...
CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...
CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...
CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...
CVE-2026-59989
Phalcon (PHP framework) versions 5.15.0 and earlier are vulnerable to a Server-Side Template Injection (SSTI) in the Volt compiler's join filter. The root cause is in resolveFilter within phalcon/Mvc/View/Engine/Volt/Compiler.zep, which inserts raw separator and array token values directly into g...
EUVD-2026-64140
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...
PT-2026-79456
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...
CVE-2026-59989: Improper Control of Generation of Code
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...
MINI-FCRG-9V25-W2PR
Bulletin has no description...
MINI-JGHC-554C-8VWM
Bulletin has no description...
MINI-PCCC-G59X-625V
Bulletin has no description...
MINI-HP26-5V48-MXJ3
Bulletin has no description...
MINI-HV52-9V5M-MR9W
Bulletin has no description...
MINI-X868-7GGM-6V54
Bulletin has no description...
MINI-78V5-P3MM-MV47
Bulletin has no description...
CVE-2026-13511
A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to...