Siemens SIMATIC S7 PLCs Web Server

SUMMARY SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization. Siemens is preparing fixes and recommends...

CVE-2026-109318

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full...

CVE-2026-109347

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109318

The Grav Git Sync plugin, versions 1.0.2 through 3.4.12 , is vulnerable to command injection when the gravuser or gravfull author modes are enabled. Authenticated content editors can execute OS commands by injecting shell substitutions into profile fields, such as username , full name , or email ...

EUVD-2026-97620

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full...

CVE-2026-109318: Improper Neutralization of Special Elements used in an OS Command

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full...

CVE-2026-103529: Unrestricted Upload of File with Dangerous Type

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's install method which will then be executed upon installation, enabling remote...

nikto

nikto Nikto escáner de servidores web - https://cirt.net/Nikto2 Documentación completa - https://github.com/sullo/nikto/wiki Ejecutar normalmente: git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h...

snallygaster

snallygaster Encuentra fugas de archivos y otros problemas de seguridad en servidores HTTP. ¿qué? snallygaster es una herramienta que busca archivos accesibles en servidores web que no deberían ser públicos y que pueden suponer un riesgo de seguridad. Los ejemplos típicos incluyen repositorios gi...

CVE-2026-108578

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

EUVD-2026-96927

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

CVE-2026-108578 Neterbit NW-431F Embedded Web Server sms.json information disclosure

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

CVE-2026-108578

A vulnerability exists in the Embedded Web Server component of Neterbit NW-431F 20250715 . Specifically, an unknown function within the /sms.json file allows for information disclosure . This vulnerability can be triggered via a remote attack . No remediation details or specific exploit informati...

scout

Scout Scout es un fuzzer de URLs y un spider para descubrir VHOSTS, archivos y directorios no revelados en un servidor web. Una lista completa de palabras está incluida en el binario, lo que significa máxima portabilidad y mínima configuración. ¡Apunta y dispara! Usage Usage: scout command...

pwnspoof

pwnSpoof de Punk Security genera archivos de registro falsos realistas para servidores web comunes con escenarios de ataque personalizables. Cada paquete de registros es único y completamente personalizable, lo que lo hace perfecto para generar escenarios CTF y para series de entrenamiento. ¿Pued...

CVE-2026-108578: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

PT-2026-110112

Name of the Vulnerable Software and Affected Versions Neterbit NW-431F version 20250715 Description An issue exists in the Embedded Web Server component within the /sms.json file. A remote attacker can manipulate an unknown function in this file to cause information disclosure. Recommendations At...

certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

CVE-2026-108161

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...

CVE-2026-108161

FusionPBX through 5.6.5 contains an OS command injection vulnerability in callrecordings::download that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the recordname filename template is enabled, attackers can embed shell metacharacters...