CVE-2025-67887

🛡️ 针对 1C-Битрикс 的 "漏洞" CVE-2025-67887/86 在 перевод 模块中的修复 1С-Битрикс 安全 1С-Битрикс 信息安全与事件监控中心通知 Telegram 频道中出现了一条关于 "Перевод" 模块存在漏洞的消息，据称该漏洞允许未经授权上传档案且不进行安全检查。 我们立即进行了检查，并且 不确认 产品中存在漏洞。只有管理员才能向 "Переводы" 模块上传文件。消息中提到的所需权限与管理员的权限一致。管理员有权修改并在项目上运行任何代码。 因此，该漏洞不存在。 https://t.me/bitrixkiberbez/76...

CVE-2026-10821

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

CVE-2026-10821

Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...

CVE-2026-10821 Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

EUVD-2026-23942

Vvveb CMS v1.0.8 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first...

CVE-2026-6257 Vvveb CMS < v1.0.8.2 Remote Code Execution via Media Management

Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by firs...

CVE-2026-6257

Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by firs...