EUVD-2026-125525

OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audiomessages endpoint...

EUVD-2026-125527

The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as...

EUVD-2026-125523

The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the...

EUVD-2026-125457

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files...

EUVD-2026-125455

The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues via repeated...

EUVD-2026-125454

Improper restriction of excessive authentication attempts in the WAMP-CRA challenge-response authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the...

EUVD-2026-125451

The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source...

EUVD-2026-125443

The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests...

CVE-2025-0282

PoC for CVE-2025-0282 A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways Overview This is a proof of concept exploit to demonstrate exploitation of CVE-2025-0282, and is based upon the exploitation strate...

CVE-2023-46805_CVE-2024-21887

CVE-2023-46805CVE-2024-21887 The script in this repository checks and exploits CVE-2023-46805 Auth Bypass and CVE-2024-21887 Remote Code Execution vulnerabilities specified in the Ivanti Connect Secure product exist. You can check vulnerability details this link...

CVE-2026-95614

The Zenitel Connect software (versions before 1.11.0 ) contains a vulnerability where the host configuration watcher applies an rsyslog configuration file from a data volume shared with the hiatus application container. A local attacker with write access to the hiatus container filesystem can exp...

CVE-2026-95615

Zenitel Connect versions before 1.11.0 are vulnerable to an OS command injection vulnerability within the audio messages API. This flaw exists in the /api/system/audio_messages endpoint due to the improper neutralization of special elements in the filename parameter. A remote authenticated user c...

CVE-2026-95613

The pREST database REST API in Zenitel Connect firmware before version 1.11.0 is vulnerable to unauthorized privilege escalation. The application uses a platform CA private key—accessible on a shared data volume—to sign and verify JWTs. It incorrectly sets the PostgreSQL session role based on an ...

CVE-2026-105623

The web interface in Zenitel Connect (versions before 1.11.0) is vulnerable to an information disclosure flaw because it serves production JavaScript source maps without authentication. A remote attacker can request these source map files to obtain the complete front-end source code, exposing API...

CVE-2026-105624

The login flow in Zenitel Connect versions before 1.11.0 is vulnerable to a denial of service (DoS) due to an overly restrictive account lockout mechanism (CWE-645). A remote attacker can repeatedly trigger failed login requests for a known or guessed username, causing a temporary lockout of targ...

CVE-2026-105622

Zenitel Connect versions before 1.11.0 are vulnerable to an improper restriction of excessive authentication attempts (CWE-307) within the WAMP-CRA (challenge-response) authentication path. The underlying cause is the lack of account lockout or rate limiting when a broker issues a challenge and t...

CVE-2026-105625

The web interface in Zenitel Connect versions prior to 1.11.0 is vulnerable to a security flaw where it loads an integration iframe without necessary sandboxing or origin restrictions . This allows a remote attacker to present phishing content to authenticated users by using a crafted frame sourc...

CVE-2026-105671

The login flow in Zenitel Connect versions before 1.11.0 is vulnerable to username enumeration . The application returns distinct error responses based on whether a submitted username exists in the system, allowing remote attackers to identify valid user accounts using crafted login requests. No ...

CVE-2024-2667-Poc

CVE-2024-2667-Poc 🚀 Description The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This...

socks5

socks5 Socks5/Socks5h server and client This project is to add protocol support for the Bridge, or it can be used alone Usage API Documentation Example Support for the CONNECT command Support for the BIND command Support for the ASSOCIATE command License Licensed under the MIT License. See LICENS...