Gibbon LMS <= v25.0.01 - File Upload to RCE

Gibbon LMS versions 25.0.1 and earlier are vulnerable to an Arbitrary File Upload that can lead to Remote Code Execution RCE. The issue stems from the rubricsvisualisesaveAjax.php endpoint, which, notably, does not require authentication. Because of this, unauthenticated attackers could potential...

edu-recon

edu-recon Orquestador autorizado de reconocimiento y triaje para ejercicios red/blue del sector educativo. Introduce los objetivos, ejecuta los escáneres, filtra el ruido y te entrega una cola de revisión clasificada en una interfaz web. Diseñado para desplegarse en tu máquina Linux Kali / infra,...

CVE_2022_3141

CVE-2022-3141: Inyección SQL en ACS EDU 3ª Generación Este repositorio contiene un análisis de seguridad detallado y un informe de la vulnerabilidad identificada como CVE-2022-3141, que afecta al sistema de tarjeta inteligente ACS EDU 3ª Generación. Resumen de la Vulnerabilidad ID de CVE :...

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Security researcher Olivier Laflamme has disclosed two independent root remote code execution RCE chains affecting the Unitree G1 EDU , including a Bluetooth Low Energy BLE path that can reach root on the robot's Locomotion PC. The flaws are tracked asCVE-2026-76639 and CVE-2026-76640 , with the...

CVE-2026-76639

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...

CVE-2026-76640

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

EUVD-2026-67166

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

CVE-2026-76640

Unitree G1 EDU firmware through 1.5.2 contains chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow an unauthenticated proximate attacker to achieve root code execution (uid 0) without pairing or credentials. The root cause involves an unquoted heredoc variable in...

CVE-2026-76640 Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

CVE-2026-76639 Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...

CVE-2026-76639

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability scored CVSS 8.8 (HIGH) . An attacker on an adjacent network can chain three weaknesses—an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key with world-readable permissio...

EUVD-2026-67165

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...

PT-2026-82733

Name of the Vulnerable Software and Affected Versions Unitree G1 EDU firmware versions prior to 1.5.3 Description Multiple chained issues exist in the BLE GATT server and WiFi provisioning stack. Unauthenticated proximate attackers can achieve root code execution without pairing or credentials...

CVE-2026-76639: Improper Limitation of a Pathname to a Restricted Directory

Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored wi...

PT-2026-82732

Name of the Vulnerable Software and Affected Versions Unitree G1 EDU firmware versions prior to 1.5.3 Description An unauthenticated remote code execution flaw allows network-adjacent attackers to execute arbitrary commands as root. This is achieved by chaining three weaknesses: an unauthenticate...

CVE-2026-76640: Out-of-bounds Write

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

MAL-2026-11083 Malicious code in edu-npm-helper-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd7f857929420503555e28dd3c702b2f60cbd705fd7be4a15009fc0536646978 No suspicious behaviors were identified in this package version. There is no evidence of install-time network activity, lifecycle scripts performing...

Malicious code in hashd-edu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f8480ae1ab46f8b6f61848c271af2819d88644df8d8f36b04b458103c5d5454 The package ships a full remote-shell backdoor that fires both at install time and at module load time. postinstall.js forks itself as a detached...

MAL-2026-6302 Malicious code in hashd-edu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f8480ae1ab46f8b6f61848c271af2819d88644df8d8f36b04b458103c5d5454 The package ships a full remote-shell backdoor that fires both at install time and at module load time. postinstall.js forks itself as a detached...

MAL-2026-5623 Malicious code in edu-npm-dependency-chain-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d5b538a93d9379ce9f4eaa885a4b22c6ec94175718176088b7a432cd67da271 No suspicious code, lifecycle scripts, network destinations, credential reads, or obfuscation were observed in this package. The package name suggest...