internalblue

Broadcom chips are used in approximately a billion of devices, such as all iPhones , MacBooks , the Samsung Galaxy S series, the older Google Nexus series, older Thinkpads , Raspberry Pis , various IoT devices, and more. In 2016, Cypress acquired the IoT division of Broadcom. Since then, firmware...

Rockwell FactoryTalk Activation Manager <= 5.02 Privilege Escalation (SD1799)

The version of Rockwell FactoryTalk Activation Manager installed on the remote Windows host is 5.02 or prior. It is, therefore, affected by a privilege escalation vulnerability. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM...

CVE-2026-16675

A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Activation Manager . The root cause is custom installer actions that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker holding valid Windo...

PT-2026-84216

Name of the Vulnerable Software and Affected Versions FactoryTalk Activation Manager affected versions not specified Description A privilege escalation issue exists due to custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repa...

EUVD-2012-5526

Malware in sbrugna...

EUVD-2024-54679

Malicious code in bioql PyPI...

CVE-2025-6388

The CVE-2025-6388 issue affects the Spirit Framework WordPress plugin up to version 1.2.14, where the custom_actions() function does not properly validate a user’s identity before authentication, enabling unauthenticated login as any user (including admins) when the attacker knows a username. Thi...

WordPress plugin Spirit Framework 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

VulnCheck KEV: CVE-2025-6388

The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the customactions function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated...

CVE-2024-7562

A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2 are affected by this issue...

CVE-2024-7562

A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2 are affected by this issue...

CVE-2024-7562

A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2 are affected by this issue...

CVE-2024-7562

A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2 are affected by this issue...

CVE-2024-7562

CVE-2024-7562 affects InstallShield Standalone MSI packages built with multiple InstallScript custom actions across versions 2021 R2, 2022 R2, and 2023 R2. The issue is a potential elevation of privilege with local attack vector and low attacker privileges, leading to impacts on confidentiality, ...

PT-2025-25334

Name of the Vulnerable Software and Affected Versions InstallShield versions 2021 R2 through 2023 R2 Description A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. Recommendations For...

CVE-2024-27314

Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users...

📄 RDPGuard 9.9.9 Privilege Escalation

RDPGuard version 9.9.9 suffers from a privilege escalation vulnerability. Exploit Title: RDPGuard 9.9.9 - Privilege Escalation SYSTEM Discovered by: Ahmet Ümit BAYRAM Discovered Date: 09.05.2025 Vendor Homepage: https://rdpguard.com Software Link: https://rdpguard.com/download.aspx Tested Version...

The vulnerability of the Custom Actions component in the software support services of Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus allows a attacker to execute XSS attacks.

The vulnerability of the Custom Actions component in the software support services of Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus exists due to the lack of protective measures for the website structure. Exploiting this...

CVE-2024-27314

Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users...

CVE-2024-27314 Stored XSS Vulnerability

Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable to stored XSS in the Custom Actions menu on the request details. This vulnerability can be exploited only by the SDAdmin role users...