399 matches found
CVE-2026-2561
JingDong JD Cloud Box AX6600 up to 4.5.1.r4533 contains a vulnerability in the jdcweb_rpc component, specifically the web_get_ddns_uptime function in the /jdcapi path. The issue allows Remote Privilege Escalation after a manipulation of the function, with the attack possible to be carried out rem...
CVE-2026-2561 JingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi web_get_ddns_uptime privileges management
A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function webgetddnsuptime of the file /jdcapi of the component jdcwebrpc. Performing a manipulation results in Remote Privilege Escalation. The attack is possible to be carried out remotely. The exploit...
PT-2026-8352
A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web get ddns uptime of the file /jdcapi of the component jdcweb rpc. Performing a manipulation results in Remote Privilege Escalation. The attack is possible to be carried out remotely. The...
JD Cloud AX6600 安全漏洞
JD Cloud AX6600 is an edge computing router developed by JD.com, a Chinese company. Versions of JD Cloud AX6600 such as 4.5.1.r4533 and earlier contain security vulnerabilities. These vulnerabilities stem from incorrect operations on the webgetddnsuptime function in the file/jdcapi, which may lea...
WMI Event Subscription Logon Timer Persistence
This Metasploit module will create a permanent WMI event subscription to achieve file-less persistence using an event filter that will trigger the payload after the system has a certain uptime. Payloads will trigger every minute until the set end time. Additionally a custom command can be specifi...
CVE-2023-31415
Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This could lead to the attacker executing arbitrary commands on the host system with permissions of t...
CVE-2023-49276
Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...
CVE-2023-49805
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket with Socket.io, but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting...
"Getting to Yes": An Anti-Sales Guide for MSPs
Most MSPs and MSSPs know how to deliver effective security. The challenge is helping prospects understand why it matters in business terms. Too often, sales conversations stall because prospects are overwhelmed, skeptical, or tired of fear-based messaging. That's why we created "Getting to Yes": ...
D-Link Nuclias Connect Directory Traversal Vulnerability
D-Link Nuclias Connect is a network management software from D-Link for centralized management of wireless access points APs, supporting multi-device remote control and reporting capabilities. A directory traversal vulnerability exists in D-Link Nuclias Connect, which stems from improper cleanup ...
EUVD-2025-35098
Uptime Kuma Server-side Template Injection SSTI in Notification Templates Allows Arbitrary File Read...
Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Summary In some Notification types e.g., Webhook, Telegram, the send function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection SSTI vulnerability that can be exploited to read arbitrary files from the server. Details The root cause is how Uptime Kuma...
GHSA-VFFH-C9PQ-4CRH Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Summary In some Notification types e.g., Webhook, Telegram, the send function allows user-controlled renderTemplate input. This leads to a Server-side Template Injection SSTI vulnerability that can be exploited to read arbitrary files from the server. Details The root cause is how Uptime Kuma...
Ensuring Safe and Reliable Updates with Qualys TruRisk™ Manifest Version Control
The Fragility of “One Bad Update” In cybersecurity, speed is non-negotiable. New vulnerabilities surface daily, and enterprises expect coverage the moment exploits are in the wild. For years, the mantra was simple: push signatures fast, and you reduce risk. Faster updates meant faster protection...
Mailpit -- Performance information disclosure
Ralph Slooten Mailpit developer reports: An HTTP endpoint was found which exposed expvar runtime information memory usage, goroutine counts, GC behavior, uptime and potential runtime flags due to the Prometheus client library dependency...
EUVD-2012-4270
Malware in sbrugna...
EUVD-2015-8156
Malware in sbrugna...
EUVD-2003-0402
Malware in sbrugna...