MultiTech Conduit import_config filename command injection RCE

Authenticated POST /api/command/uploadconfig with malicious filename breaks out of importconfig shell quoting. """MultiTech Conduit AEP importconfig filename command injection root RCE.""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclient import...

MultiTech Conduit AEP — Authenticated Command Injection in `import_config` → Roo — Detect

Fingerprint / reachability check for MultiTech Conduit AEP — Authenticated Command Injection in importconfig → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for MultiTech Conduit AEP — Authenticated Command Injection in importconfig → Root RCE""" from kittysploit import from...

CVE-2026-52835

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

CVE-2026-52835 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

EUVD-2026-84067

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

CVE-2026-52835 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

EUVD-2021-25682

Malware in sbrugna...

CVE-2021-39321

Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wpajaxheateorsssimportconfig AJAX action due to deserialization of unvalidated user supplied inputs via the importconfig function found in the /admin/class-sassy-social-share-admin.php file. Th...

CVE-2021-39321

Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wpajaxheateorsssimportconfig AJAX action due to deserialization of unvalidated user supplied inputs via the importconfig function found in the /admin/class-sassy-social-share-admin.php file. Th...

WordPress security vulnerabilities

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress plugin Sassy Social Share, which stems from a lack ...