CVE-2026-48908

🚨 CVE-2026-48908 — Full Server Compromise via Arbitrary File Upload Critical Unauthenticated File Upload → Remote Code Execution RCE A critical vulnerability in SP Page Builder allows unauthenticated attackers to upload arbitrary files and achieve Remote Code Execution RCE , potentially leading t...

CrafterCMS-CVE-2025-6384

CrafterCMS Authenticated RCE - Groovy Sandbox Bypass CVE-2025-6384 A Proof of Concept for an authenticated Remote Code Execution vulnerability in CrafterCMS. Vulnerability Summary An authenticated user with developer privileges can bypass the Groovy script sandbox in Crafter Studio to achieve...

CVE-2026-55573

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...

CVE-2026-27944

CVE-2026-27944 - Nginx UI Unauthenticated Backup Download & Decryption https://img.shields.io/badge/python-3.6+-blue.svg https://img.shields.io/badge/license-MIT-green https://img.shields.io/badge/PoC-Exploit-red A proof‑of‑concept PoC exploit for CVE‑2026‑27944, a critical vulnerability in Nginx...

CVE-2026-92593 Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl - View::renderObjectTemplate sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml. Because Craft/Yii HMAC tokens are not...

PT-2026-94110

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.10.0 through 5.10.12 Description An authenticated low-privilege control panel user with edit rights on a single element type can achieve server-side template injection, leading to arbitrary PHP code execution and full serv...

CVE-2025-14601

vsDesk task scheduler passes unsanitized input to OS commands; an authenticated admin can inject arbitrary commands (CVSS 8.6 High). Patch available in versions 14.0101 and later from vendor https://vsdesk.ru/. No in-the-wild exploitation reported. Advisory: https://github.com/klsecservices/Advis...

CVE-2025-14601 vsDesk Task Scheduler OS Command Injection

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or...

CVE-2026-67357

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP getserversettings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67357: Exposure of Sensitive Information to an Unauthorized Actor

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP getserversettings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-6249: Unrestricted Upload of File with Dangerous Type

Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious...

CVE-2026-26045

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available ...

CVE-2026-26045: Improper Control of Generation of Code

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available ...

PYSEC-2026-33

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing unauthenticated remote...

Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances

Cybersecurity researchers have disclosed details of multiple critical-severity security flaws affecting Coolify, an open-source, self-hosting platform, that could result in authentication bypass and remote code execution. The list of vulnerabilities is as follows - CVE-2025-66209 CVSS score: 10.0...

CVE-2025-57644

Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting in remote code execution. In addition, improper input validation allows for arbitrary file write a...

CVE-2025-34161

Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creatio...

CVE-2024-47169

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those...

CVE-2024-47169: Path Traversal: '.../...//'

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those...

CVE-2023-0829: Improper Neutralization of Input During Web Page Generation

Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner either a customer or an additional user, can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious subscription...