CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

Summary Missing authorization checks on three IAM API endpoints GET /api/roles, GET /api/roles/name, GET /api/privileges allow any authenticated user — regardless of their assigned permissions — to enumerate the complete list of system privileges and role definitions. An attacker with only a...

GHSA-CVW4-55PP-3HFQ Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

Summary Missing authorization checks on three IAM API endpoints GET /api/roles, GET /api/roles/name, GET /api/privileges allow any authenticated user — regardless of their assigned permissions — to enumerate the complete list of system privileges and role definitions. An attacker with only a...

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening. "This vulnerability gives an unauthenticated attacker remote control over PaperCut's...

GHSA-FWWW-CP23-7F5G Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Asset / scope: Yamcs 5.12.7 WebSocket topics packets, algorithm-status, mdb-changes Summary Several WebSocket subscription handlers do not perform the privilege check that their REST counterparts enforce, so a principal subscribing over WebSocket receives data the REST API would have scoped or...

Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Asset / scope: Yamcs 5.12.7 WebSocket topics packets, algorithm-status, mdb-changes Summary Several WebSocket subscription handlers do not perform the privilege check that their REST counterparts enforce, so a principal subscribing over WebSocket receives data the REST API would have scoped or...

GHSA-962X-CCWF-8X6P Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges e.g., an unprivileged "Guest", to bypass intended access controls. An attacker can exploit these...

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges e.g., an unprivileged "Guest", to bypass intended access controls. An attacker can exploit these...

exphub

Notice Alla fine ho comunque pensato che avere uno script separato per ogni vulnerabilità fosse molto scomodo, quindi ho riunito tutti gli script PoC ed exploit in un unico posto, consentendo scansione e sfruttamento con un solo clic. Dato che ultimamente sto lavorando all'integrazione, Exphub è...

snorby

Snorby github.com/Snorby/snorby github.com/Snorby/snorby/issues github.com/Snorby/snorby/wiki irc.freenode.net snorby Descrizione Snorby è un'applicazione web in Ruby on Rails per il monitoraggio della sicurezza di rete che si interfaccia con i più diffusi sistemi di rilevamento delle intrusioni...

GHSA-3G44-3M7X-CGG2 Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...

EUVD-2026-67836

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55511 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55511

Yamcs is a mission control framework. In versions prior to 5.12.8 and 5.13.2 , an authenticated user holding the SystemPrivilege.ControlArchiving privilege can inject arbitrary Java into the StreamSQL aggregate expression compiler by crafting a malicious double-quoted column name. The column name...

obike

Descrizione del Protocollo oBike BLE/HTTP Questo documento fornisce un'analisi dei protocolli di comunicazione oBike a partire da gennaio 2018. I risultati sono stati presentati alla insomni'hack security conference 2019: slides registrazione nonché all'AREA41 security conference 2018: slides...

bscan

:mag: uno strumento di enumerazione di target asincrono :magright: Sinossi bscan è un'utilità da riga di comando per eseguire raccolta attiva di informazioni ed enumerazione di servizi. Al suo interno, bscan avvia in modo asincrono processi di note utilità di scansione, riutilizzando i risultati...

CVE-2026-51992

CVE-2026-51992 All'interno di ClickHouse esiste una funzionalità che consente a un utente con i permessi corretti di creare dizionari per interagire con diversi database ed eseguire query specifiche su di essi. Per PostgreSQL, le query SELECT vengono racchiuse in un'istruzione COPY QUERY TO STDOU...

GHSA-569V-Q83C-3J3G Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Summary POST /api/v1/projects/project/views/view/buckets/bucket mass-assigns the request body's projectviewid onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied project, view pair; the body's projectviewid is never validated. A...

Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Summary POST /api/v1/projects/project/views/view/buckets/bucket mass-assigns the request body's projectviewid onto the bucket row. The permission check only verifies that the URL-supplied bucket already belongs to the URL-supplied project, view pair; the body's projectviewid is never validated. A...