CVE-2025-57819-FreePBX-RCE2Root

CVE-2025-57819 — FreePBX SQLi → RCE → Root Full-chain PoC for CVE-2025-57819. Unauthenticated error-based SQL injection in FreePBX's endpoint module chains into a root shell via cron job injection and incron privilege escalation. For authorized testing and research only. Do not use against system...

PT-2026-104496

Name of the Vulnerable Software and Affected Versions Rich Showcase for Google Reviews versions prior to 7.1.4 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject...

compactor (>=0.2.0, <=0.3.0), graphite-beacon (>=0.23.0, <=0.26.0) +1 more potentially affected by CVE-2026-103262 via tornado (4.1.0)

tornado PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - compactor =0.2.0, =0.23.0, =0.25.1, =0.25.4.2 Source cves: CVE-2026-103262 Source advisory: OSV:GHSA-CHX6-46F5-W4VP...

CVE-2026-100714

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in...

CVE-2026-100715

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...

Symlink Attack

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Symlink Attack via the DataDump cron process due to insufficient validation of intermediate path components in the export destination. An attacker can gain unauthorized ownership of...

CVE-2026-100715

Froxlor versions through 2.3.10 are vulnerable to arbitrary file deletion due to a symlink following flaw in the FTP data deletion cron task (deleteFtpData ). The vulnerability occurs because the FileDir::makeCorrectDir() function is called without the $fixed_homedir argument, causing the symlink...

CVE-2026-100715 Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...

CVE-2026-100715 Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...

CVE-2026-100714 Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in...

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

CVE-2026-100578

OpenClaw npm package openclaw before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn...

CVE-2026-100580

OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...

CVE-2026-100568

OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to read and execute ownerless command jobs. Attackers can inspect stored environment variables and force-run disabled or unscheduled command jobs to access secret...

CVE-2026-100580 OpenClaw before 2026.7.1 Remote Code Execution via cron tool

OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...

CVE-2026-100580

The OpenClaw (npm package 'openclaw' ) before version 2026.7.1 contains a vulnerability where the model-facing cron tool improperly handles case sensitivity. A mixed-case payload kind can bypass the agent-facing shell-execution guard and be normalized into a command job. An actor capable of steer...

EUVD-2026-87471

OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...

CVE-2026-100580 OpenClaw before 2026.7.1 Remote Code Execution via cron tool

OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...

CVE-2026-100580 OpenClaw before 2026.7.1 Remote Code Execution via cron tool

OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...