PT-2026-6549

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.2.4 PrestaShop versions prior to 9.0.3 Description PrestaShop contains a time-based user enumeration issue in its user authentication functionality. An attacker can determine if a customer account exists by...

EndRun Technologies Sonoma Cross-site Scripting (CVE-2025-60967)

Cross Site Scripting XSS vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

EndRun Technologies Sonoma OS Command Injection (CVE-2025-60959)

OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensitive information. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

EndRun Technologies Sonoma Cross-Site Request Forgery (CVE-2025-60956)

Cross Site Request Forgery CSRF vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information. This plugin only works with...

PHP Address Book SQL注入漏洞

PHP Address Book is a web-based contact management system developed by chatelao. Version 9.0.0.1 of PHP Address Book has a SQL injection vulnerability. This vulnerability stems from a time-based blind SQL injection in the photo.php endpoint. Attackers can extract information by injecting speciall...

Reference-Free EM Validation Flow for Detecting Triggered Hardware Trojans

Hardware Trojans HTs threaten the trust and reliability of integrated circuits ICs, particularly when triggered HTs remain dormant during standard testing and activate only under rare conditions. Existing electromagnetic EM side-channel-based detection techniques often rely on golden references o...

PT-2026-5833

PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' parameter. Attackers can inject crafted SQL statements with time delays to extract information by observing response times in the photo.php...

EndRun Technologies Sonoma OS Command Injection (CVE-2025-60964)

OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, gain sensitive information, and possibly other unspecified impacts. This plugin...

EndRun Technologies Sonoma OS Command Injection (CVE-2025-60960)

OS Command Injection vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0071-000 Ver 4.00 allows attackers to execute arbitrary code, cause a denial of service, gain escalated privileges, and gain sensitive information. This plugin only works with Tenable.ot. Please...

EndRun Technologies Sonoma Path Traversal (CVE-2025-60969)

Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server GPS F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEV...

CVE-2026-23515

Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated...

CVE-2026-23515

Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated...

CVE-2026-23515

The CVE affects Signal K Server’s set-system-time plugin, with exploitation possible before version 1.5.0. Authenticated users with write permissions (or any user if server security is disabled) can trigger command injection by sending crafted navigation.datetime values via WebSocket delta messag...

CVE-2026-23515 RCE - Command Injection in Signal K set-system-time plugin

Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated...

CVE-2026-23515 RCE - Command Injection in Signal K set-system-time plugin

Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated...

CVE-2026-23515 RCE - Command Injection in Signal K set-system-time plugin

Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated...

signalk-server (>=1.0.0-0, <=1.1.2) potentially affected by CVE-2026-23515 via @signalk/set-system-time (>=1.0.0, <=1.2.0)

@signalk/set-system-time NPM version =1.0.0, =1.0.0-0, =1.1.2 Source cves: CVE-2026-23515 Source advisory: OSV:GHSA-P8GP-2W28-MHWG...

Command Injection

Overview @signalk/set-system-time is a Signal K server plugin to set system date & time on Signal K data, usually from a GPS Affected versions of this package are vulnerable to Command Injection via the stream.onValue function. An attacker can execute arbitrary shell commands on the server by...

Signal K set-system-time plugin vulnerable to RCE - Command Injection

Summary A Command Injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K...

signalk-server (>=1.0.0-0, <=1.1.2) potentially affected by CVE-2026-23515 via @signalk/set-system-time (>=1.0.0, <=1.2.0)

@signalk/set-system-time NPM version =1.0.0, =1.0.0-0, =1.1.2 Source cves: CVE-2026-23515 Source advisory: SNYK:JS-SIGNALKSETSYSTEMTIME-15182653...