CVE-2026-105389 feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload...

CVE-2026-105388 feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection

A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument groupid causes sql injection. The attack can be...

EUVD-2026-92765

A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument groupid causes sql injection. The attack can be...

CVE-2026-105388

A SQL injection vulnerability exists in feelec-yishu feelcrm-os version 1.0.0 . The flaw is located in the index function of the App/Feelcrm/Index/Controller/MemberController.class.php file within the Member Endpoint component. Improper handling of the group_id argument allows an attacker to perf...

CVE-2026-105388 feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection

A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the argument groupid causes sql injection. The attack can be...

Yachtcontrol systemcall RCE (CVE-2019-17270)

Exploits CVE-2019-17270 in Yachtcontrol webapplication 1.0: unauthenticated OS command injection via /pages/systemcall.php?command=. !/usr/bin/env python3 -- coding: utf-8 -- """Yachtcontrol systemcall.php command injection CVE-2019-17270.""" import re import urllib.parse from kittysploit import...

Palo Alto GlobalProtect Command Injection (CVE-2024-3400)

Exploits CVE-2024-3400 in PAN-OS GlobalProtect: SESSID path traversal writes into devicetelemetry cron directories, yielding root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto GlobalProtect PAN-OS command injection CVE-2024-3400.""" import secrets import time from...

CVE-2025-47827

CVE-2025-47827 Proof-of-concept and vulnerability report for CVE-2025-47827. Contents Description Disclosure Impact Detection Mitigation Binaries Proof of Concept Resources Description In IGEL OS before v11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a...

Exploit for CVE-2026-105134

CVE-2026-105134-style OS Command Injection Lab A minimal, sel...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: crosectypec: Stale pointers have been set to zero. The function crostypecgetswitchhandles allocates four pointers when obtaining type-c switch handles. These pointers are all freed if none of them are obtained...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been resolved through improved UI handling. This issue is fixed in Safari 17.4, iOS 17.4, iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, and watchOS 10.4. A malicious website may exfiltrate audio data across origins...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved memory handling. This issue is fixed in Safari 17.3, iOS 16.7.5, and iPadOS 16.7.5; iOS 17.3, and iPadOS 17.3; macOS Sonoma 14.3; tvOS 17.3; and watchOS 10.3. Processing web content may lead to arbitrary code execution...

Astra Linux – Vulnerability in Ansible

A vulnerability was discovered in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, and 2.7.x before 2.7.16 and earlier. In these versions, the nxosfilecopy module of Ansible can be used to copy files to the flash or bootflash on NXOS devices. Malicious code could manipulate the...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Views in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. Chromium security severity: Low...

Astra Linux – Vulnerability in WebKit2GTK

A memory corruption issue has been resolved through improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4, and iPadOS 16.4, as well as iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Avoid scheduling in rtasosterm. It is unsafe to use rtasbusydelay to handle a busy status from the IBM,os-term RTAS function in rtasosterm: Kernel Panic – Not Syncing: Attempted to kill init! Exitcode = 0x0000000b...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The vulnerability in Google Chrome videos on ChromeOS before version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in WebKit2GTK

A correctness issue was addressed through improved checks. This issue has been fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26. Processing maliciously crafted web content may result in an unexpected process crash...

Astra Linux – Vulnerability in Node.js

A OS command injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost check. This vulnerability can be easily exploited, as the IsIPAddress function does not properly check whether an IP address is invalid before making DBS requests, thereby...