GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-94

Allowed-with-Review

Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

9051 vulnerabilities reference this CWE, most recent first.

CVE-2026-0236 (GCVE-0-2026-0236)

Vulnerability from cvelistv5 – Published: 2026-05-13 17:55 – Updated: 2026-05-15 03:56
VLAI
Title
Prisma Browser: Code Injection Enables Security Controls Bypass
Summary
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.
Severity
7.3 (High)
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-14 00:00 UTC
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
Vendor Product Version
Palo Alto Networks Prisma Browser Affected: 0 , < 146.16.6.165 (custom)
    cpe:2.3:a:palo_alto_networks:prisma_browser:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-05-13 16:00
Credits
Cisors
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0236",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T03:56:03.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Prisma Browser",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "146.16.6.165",
                  "status": "unaffected"
                }
              ],
              "lessThan": "146.16.6.165",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "No special configuration is required to be affected by this issue."
            }
          ],
          "value": "No special configuration is required to be affected by this issue."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:palo_alto_networks:prisma_browser:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "146.16.6.165",
                  "versionStartIncluding": "146.16.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Cisors"
        }
      ],
      "datePublic": "2026-05-13T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A code injection vulnerability in Palo Alto Networks Prisma\u00ae Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser."
            }
          ],
          "value": "A code injection vulnerability in Palo Alto Networks Prisma\u00ae Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T17:55:04.370Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2026-0236"
        }
      ],
      "solutions": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n                                \u003ctd\u003ePrisma Browser\u003cbr\u003e\u003c/td\u003e\n                                \n                                \u003ctd\u003eUpgrade to 146.16.6.165 or later.\u003c/td\u003e\n                            \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
            }
          ],
          "value": "VERSION          SUGGESTED SOLUTION\nPrisma Browser   Upgrade to 146.16.6.165 or later."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-13T16:00:00.000Z",
          "value": "Initial publication."
        }
      ],
      "title": "Prisma Browser: Code Injection Enables Security Controls Bypass",
      "workarounds": [
        {
          "lang": "eng",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "No known workarounds exist for this issue."
            }
          ],
          "value": "No known workarounds exist for this issue."
        }
      ],
      "x_affectedList": [
        "Prisma Browser 146.16.0",
        "Prisma Browser 146.16.1",
        "Prisma Browser 146.16.2",
        "Prisma Browser 146.16.3",
        "Prisma Browser 146.16.4",
        "Prisma Browser 146.16.5"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2026-0236",
    "datePublished": "2026-05-13T17:55:04.370Z",
    "dateReserved": "2025-11-03T20:43:57.172Z",
    "dateUpdated": "2026-05-15T03:56:03.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0144

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[REVIVE-SA-2026-003] Revive Adserver Vulnerabilities
Summary
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-003 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-003 ------------------------------------------------------------------------ Date: 2026-06-25 Risk Level: Medium to High Applications affected: Revive Adserver Versions affected: <= 6.0.7 Versions not affected: >= 6.0.8 Website: https://www.revive-adserver.com/ ======================================================================== ======================================================================== 1. Improper Access Control ======================================================================== Vulnerability Type: CWE-284: Improper Access Control CVE-ID: CVE-2026-50739 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3780709 https://github.com/revive-adserver/revive-adserver/commit/c03a0b6d https://cwe.mitre.org/data/definitions/284.html ======================================================================== 2. Reflected XSS ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-50740 Risk level: Medium CVSS Base Score: 6.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3780806 https://github.com/revive-adserver/revive-adserver/commit/03d9ad8b https://cwe.mitre.org/data/definitions/79.html ======================================================================== 3. Remote Code Execution ======================================================================== Vulnerability Type: CWE-94: Code Injection CVE-ID: CVE-2026-50741 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3780854 https://hackerone.com/reports/3781492 https://github.com/revive-adserver/revive-adserver/commit/3d1485de https://github.com/revive-adserver/revive-adserver/commit/becaf6e7 https://cwe.mitre.org/data/definitions/94.html ======================================================================== 4. Stored XSS ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-50742 Risk level: Medium CVSS Base Score: 4.4 CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3781311 https://github.com/revive-adserver/revive-adserver/commit/91abb6ab https://cwe.mitre.org/data/definitions/79.html ======================================================================== 5. Cross-Site Request Forgery ======================================================================== Vulnerability Type: CWE-352: Cross-Site Request Forgery CVE-ID: CVE-2026-50743 Risk level: Medium CVSS Base Score: 5.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3781691 https://github.com/revive-adserver/revive-adserver/commit/e3c84d6f https://cwe.mitre.org/data/definitions/352.html ======================================================================== 6. Improper Access Control ======================================================================== Vulnerability Type: CWE-284: Improper Access Control CVE-ID: CVE-2026-50744 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3783738 https://github.com/revive-adserver/revive-adserver/commit/3e04cb4a https://cwe.mitre.org/data/definitions/284.html ======================================================================== 7. Reflected XSS ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-50745 Risk level: Medium CVSS Base Score: 4.7 CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3793243 https://github.com/revive-adserver/revive-adserver/commit/a570a0c1 https://cwe.mitre.org/data/definitions/79.html ======================================================================== Solution ======================================================================== ======================================================================== Contact Information ======================================================================== The security contact for Revive Adserver can be reached at: <security AT revive-adserver DOT com>. Please review https://www.revive-adserver.com/security/ before doing so. -- Matteo Beccati On behalf of the Revive Adserver Team https://www.revive-adserver.com/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
Matteo Beccati
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Revive Adserver Vulnerabilities",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Beccati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "========================================================================\nRevive Adserver Security Advisory                     REVIVE-SA-2026-003\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-003\n------------------------------------------------------------------------\nDate: 2026-06-25\nRisk Level: Medium to High\nApplications affected: Revive Adserver\nVersions affected: \u003c= 6.0.7\nVersions not affected: \u003e= 6.0.8\nWebsite: https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\n1. Improper Access Control\n========================================================================\nVulnerability Type:    CWE-284: Improper Access Control\nCVE-ID:                CVE-2026-50739\nRisk level:            Medium\nCVSS Base Score:       4.3\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780709\nhttps://github.com/revive-adserver/revive-adserver/commit/c03a0b6d\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n2. Reflected XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-50740\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780806\nhttps://github.com/revive-adserver/revive-adserver/commit/03d9ad8b\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n3. Remote Code Execution\n========================================================================\nVulnerability Type:    CWE-94: Code Injection\nCVE-ID:                CVE-2026-50741\nRisk level:            High\nCVSS Base Score:       8.8\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3780854\nhttps://hackerone.com/reports/3781492\nhttps://github.com/revive-adserver/revive-adserver/commit/3d1485de\nhttps://github.com/revive-adserver/revive-adserver/commit/becaf6e7\nhttps://cwe.mitre.org/data/definitions/94.html\n\n\n========================================================================\n4. Stored XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-50742\nRisk level:            Medium\nCVSS Base Score:       4.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3781311\nhttps://github.com/revive-adserver/revive-adserver/commit/91abb6ab\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\n5. Cross-Site Request Forgery\n========================================================================\nVulnerability Type:    CWE-352: Cross-Site Request Forgery\nCVE-ID:                CVE-2026-50743\nRisk level:            Medium\nCVSS Base Score:       5.4\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3781691\nhttps://github.com/revive-adserver/revive-adserver/commit/e3c84d6f\nhttps://cwe.mitre.org/data/definitions/352.html\n\n\n========================================================================\n6. Improper Access Control\n========================================================================\nVulnerability Type:    CWE-284: Improper Access Control\nCVE-ID:                CVE-2026-50744\nRisk level:            Medium\nCVSS Base Score:       4.3\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3783738\nhttps://github.com/revive-adserver/revive-adserver/commit/3e04cb4a\nhttps://cwe.mitre.org/data/definitions/284.html\n\n\n========================================================================\n7. Reflected XSS\n========================================================================\nVulnerability Type:    CWE-79: Cross-site Scripting\nCVE-ID:                CVE-2026-50745\nRisk level:            Medium\nCVSS Base Score:       4.7\nCVSS Vector:           CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N\n------------------------------------------------------------------------\n\nDescription\n-----------\n\n\nResolution\n----------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3793243\nhttps://github.com/revive-adserver/revive-adserver/commit/a570a0c1\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n\u003csecurity AT revive-adserver DOT com\u003e.\n\nPlease review https://www.revive-adserver.com/security/ before doing so.\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-352",
              "description": "CWE-352",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/19"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/284.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/352.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/94.html"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/03d9ad8b"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/3d1485de"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/3e04cb4a"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/91abb6ab"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/a570a0c1"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/becaf6e7"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/c03a0b6d"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e3c84d6f"
        },
        {
          "url": "https://hackerone.com/reports/3780709"
        },
        {
          "url": "https://hackerone.com/reports/3780806"
        },
        {
          "url": "https://hackerone.com/reports/3780854"
        },
        {
          "url": "https://hackerone.com/reports/3781311"
        },
        {
          "url": "https://hackerone.com/reports/3781492"
        },
        {
          "url": "https://hackerone.com/reports/3781691"
        },
        {
          "url": "https://hackerone.com/reports/3783738"
        },
        {
          "url": "https://hackerone.com/reports/3793243"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.revive-adserver.com/"
        },
        {
          "url": "https://www.revive-adserver.com/security/"
        },
        {
          "url": "https://www.revive-adserver.com/security/revive-sa-2026-003"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[REVIVE-SA-2026-003] Revive Adserver Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0144",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/19",
            "automated": true,
            "contentSha256": "c5bcb5ce1b70d5aea4ade5341e47213742f349f29dea887b1d4dc890d0f3bbce",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-07T07:20:11Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0144"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0135

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:53
VLAI
Title
[0day-rubbish] CacheGuard OS UF-2.5.2 Authenticated RCE via config-import eval injection (8.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in CacheGuard OS UF-2.5.2. Type: Authenticated RCE via config-import eval injection (CWE-94) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Impact: Authenticated escalation from the restricted admin shell to arbitrary command execution, placing gateway configuration, WAF rules, and TLS keys under attacker control. Authentication: authenticated (requires valid session) Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/cacheguard-authed-conf-inject-eval-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Cacheguard OS UF-2.5.2 Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "OS UF-2.5.2",
          "vendor": "Cacheguard",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in CacheGuard OS UF-2.5.2.\n\nType: Authenticated RCE via config-import eval injection (CWE-94)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\nImpact: Authenticated escalation from the restricted admin shell to arbitrary command execution, placing gateway \nconfiguration, WAF rules, and TLS keys under attacker control.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/cacheguard-authed-conf-inject-eval-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:53:08Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/94"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/94"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/cacheguard-authed-conf-inject-eval-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/94"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] CacheGuard OS UF-2.5.2 Authenticated RCE via config-import eval injection (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0135",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/94",
            "automated": true,
            "contentSha256": "7254e985900bc76d1dd06ef6edb96b9aa229d3ab580f5355ae8cafa1228a0c1a",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/94",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-25T17:10:55Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-11T11:53:08Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0135"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0093

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:52
VLAI
Title
[0day-rubbish] webMethods Microservices Runtime (MSR) 10.x (other versions with the same XSLT module are likely affected) Pre-authentication RCE (default factory credentials + XSLT extension functions) (9.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in webMethods Microservices Runtime (MSR) 10.x (other versions with the same XSLT module are likely affected). Type: Pre-authentication RCE (default factory credentials + XSLT extension functions) (CWE-94) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Remote code execution on the integration server as the integration service user. An attacker can compromise integration flows, credentials, and the connected backend systems. Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/softwareag-webmethods-msr-xslt-xalan-extension-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Microservices Runtime",
          "vendor": "Webmethods",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in webMethods Microservices Runtime (MSR) 10.x (other \nversions with the same XSLT module are likely affected).\n\nType: Pre-authentication RCE (default factory credentials + XSLT extension functions) (CWE-94)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Remote code execution on the integration server as the integration service user. An attacker can compromise \nintegration flows, credentials, and the connected backend systems.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/softwareag-webmethods-msr-xslt-xalan-extension-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:52:59Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/91"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/91"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/softwareag-webmethods-msr-xslt-xalan-extension-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/91"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] webMethods Microservices Runtime (MSR) 10.x (other versions with the same XSLT module are likely affected) Pre-authentication RCE (default factory credentials + XSLT extension functions) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0093",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/91",
            "automated": true,
            "contentSha256": "85c5f0bd6e21109ea0b33f445043b439563875dbb913831d3c4c3d08be745713",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/91",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T15:28:12Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:52:59Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0093"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0090

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] NCache Enterprise 5.3.6 (other versions with the same default-disabled security and handler logic are likely affected) Pre-authentication RCE (missing auth + attacker assembly load) (9.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in NCache Enterprise 5.3.6 (other versions with the same default-disabled security and handler logic are likely affected). Type: Pre-authentication RCE (missing auth + attacker assembly load) (CWE-94) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated remote code execution on the cache server as the ncache service user, exposing cached application data and the host. Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/ncache-enterprise-unauth-assembly-load-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "NCache Enterprise",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in NCache Enterprise 5.3.6 (other versions with the \nsame default-disabled security and handler logic are likely affected).\n\nType: Pre-authentication RCE (missing auth + attacker assembly load) (CWE-94)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated remote code execution on the cache server as the ncache service user, exposing cached \napplication data and the host.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/ncache-enterprise-unauth-assembly-load-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/88"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/88"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/ncache-enterprise-unauth-assembly-load-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/88"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] NCache Enterprise 5.3.6 (other versions with the same default-disabled security and handler logic are likely affected) Pre-authentication RCE (missing auth + attacker assembly load) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0090",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/88",
            "automated": true,
            "contentSha256": "1719e9c3a4af6db4761c511db2236f9e4f4906dca14b0a6f2cb708c29b387acc",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/88",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T15:27:31Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0090"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0089

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:52
VLAI
Title
[0day-rubbish] myDBR 7.5.4 (build 5454) (other versions with the same file-editor are likely affected) Authenticated RCE (admin file editor + default credentials) (8.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in myDBR 7.5.4 (build 5454) (other versions with the same file-editor are likely affected). Type: Authenticated RCE (admin file editor + default credentials) (CWE-94) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Impact: Authenticated remote code execution on the reporting server as www-data, exposing business reports and the database connection. Authentication: authenticated (requires valid session) Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/mydbr-file-editor-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Mydbr Mydbr Affected: unknown
Create a notification for this product.
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Mydbr",
          "vendor": "Mydbr",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in myDBR 7.5.4 (build 5454) (other versions with the \nsame file-editor are likely affected).\n\nType: Authenticated RCE (admin file editor + default credentials) (CWE-94)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\nImpact: Authenticated remote code execution on the reporting server as www-data, exposing business reports and the \ndatabase connection.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/mydbr-file-editor-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:52:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/87"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/87"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/mydbr-file-editor-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/87"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] myDBR 7.5.4 (build 5454) (other versions with the same file-editor are likely affected) Authenticated RCE (admin file editor + default credentials) (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0089",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/87",
            "automated": true,
            "contentSha256": "88ab36760befd15384dbb73078fba2f59f97805fff610f3c821eaf555138a23b",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/87",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T15:27:18Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:52:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0089"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0087

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:52
VLAI
Title
[0day-rubbish] LogicalDOC Enterprise Edition 9.3 (the incomplete CVE-2024-54448 fix suggests earlier 9.x versions are likely affected) Authenticated RCE (automation sandbox bypass + default credentials) (8.8)
Summary
0day Rubbish Research Team is publicly disclosing a vulnerability in LogicalDOC Enterprise Edition 9.3 (the incomplete CVE-2024-54448 fix suggests earlier 9.x versions are likely affected). Type: Authenticated RCE (automation sandbox bypass + default credentials) (CWE-94) CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Impact: Authenticated remote code execution on the document management server in the Tomcat context, exposing the document repository. Authentication: authenticated (requires valid session) Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/logicaldoc-automation-sandbox-bypass-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Enterprise Edition",
          "vendor": "Logicaldoc",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in LogicalDOC Enterprise Edition 9.3 (the incomplete \nCVE-2024-54448 fix suggests earlier 9.x versions are likely affected).\n\nType: Authenticated RCE (automation sandbox bypass + default credentials) (CWE-94)\nCVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\nImpact: Authenticated remote code execution on the document management server in the Tomcat context, exposing the \ndocument repository.\nAuthentication: authenticated (requires valid session)\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/logicaldoc-automation-sandbox-bypass-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:52:40Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/85"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/85"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/logicaldoc-automation-sandbox-bypass-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/85"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] LogicalDOC Enterprise Edition 9.3 (the incomplete CVE-2024-54448 fix suggests earlier 9.x versions are likely affected) Authenticated RCE (automation sandbox bypass + default credentials) (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0087",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/85",
            "automated": true,
            "contentSha256": "5cd857423ff6a9b8585d496058aa046c1b198ed7c2a82c42e6020e1c92f78d25",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/85",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-22T15:26:49Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-11T11:52:40Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0087"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0072

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
Title
[0day-rubbish] Workflow Enterprise 9.1.0.1 Pre-authentication RCE (expression injection) (9.8)
Summary
TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] Workflow Enterprise 9.1.0.1 Pre-authentication RCE (expression injection) (9.8) FROM: disclosure () 0day-rubbish com ----BODY---- 0day Rubbish Research Team is publicly disclosing a vulnerability in Workflow Enterprise 9.1.0.1. Type: Pre-authentication RCE (expression injection) (CWE-94) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated root RCE on the Joget application server; full control of the workflow automation platform and its integrated ERP and approval systems. Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/joget-jrxml-expr-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
disclosure via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Workflow Enterprise",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TO: fulldisclosure () seclists org\nSUBJECT: [0day-rubbish] Workflow Enterprise 9.1.0.1 Pre-authentication RCE (expression injection) (9.8)\nFROM: disclosure () 0day-rubbish com\n----BODY----\n0day Rubbish Research Team is publicly disclosing a vulnerability in Workflow Enterprise 9.1.0.1.\n\nType: Pre-authentication RCE (expression injection) (CWE-94)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated root RCE on the Joget application server; full control of the workflow automation platform and \nits integrated ERP and approval systems.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/joget-jrxml-expr-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/51"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/51"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/joget-jrxml-expr-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/51"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Workflow Enterprise 9.1.0.1 Pre-authentication RCE (expression injection) (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0072",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/51",
            "automated": true,
            "contentSha256": "02f6d5cb1cd6f8ea07966e7abd2572653b35fe1f77feea8d633b3894a16f7550",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/51",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-15T07:26:21Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0072"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1-2026-0021

Vulnerability from gna-1 – Published: 2026-03-23 12:30 – Updated: 2026-03-23 12:30
VLAI
Title
Critical RCE Vulnerability reported in Windchill
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in windchill FlexPLM, Windchill PDMLink.This issue affects FlexPLM: through 13.0.3.0; PDMLink: through 13.0.3.0.
Severity
10 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
GNA-1 This instance
References
Impacted products
Vendor Product Version
windchill FlexPLM Affected: 0 , ≤ 13.0.3.0 (semver)
Create a notification for this product.
Windchill PDMLink Affected: 0 , ≤ 13.0.3.0 (semver)
Create a notification for this product.
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FlexPLM",
          "vendor": "windchill",
          "versions": [
            {
              "lessThanOrEqual": "13.0.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "PDMLink",
          "vendor": "Windchill",
          "versions": [
            {
              "lessThanOrEqual": "13.0.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in windchill FlexPLM, Windchill PDMLink.\u003cp\u003eThis issue affects FlexPLM: through 13.0.3.0; PDMLink: through 13.0.3.0.\u003c/p\u003e"
            }
          ],
          "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in windchill FlexPLM, Windchill PDMLink.This issue affects FlexPLM: through 13.0.3.0; PDMLink: through 13.0.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://support.eacpds.com/hc/en-us/article_attachments/47430019070996"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ptc.com/en/support/article/CS466318?_gl=1*196gmri*_gcl_au*Njc4ODc0NTE4LjE3NzQxNzI5NTc.*_ga*MTY0OTgyOTM1NC4xNzc0MTcyOTU2*_ga_7NMP2MSYPM*czE3NzQxNzI5NTYkbzEkZzAkdDE3NzQxNzI5ODQkajMyJGwwJGgw\u0026as=0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Critical RCE Vulnerability reported in Windchill",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-0021"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "datePublished": "2026-03-23T12:30:40.249187Z",
    "dateUpdated": "2026-03-23T12:30:40.249187Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-0021",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-03-23T12:30:40.249187Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-71389 (GCVE-0-2025-71389)

Vulnerability from cvelistv5 – Published: 2026-07-23 21:16 – Updated: 2026-07-28 01:48
VLAI
Title
Cal.com before 5.9.9 Remote Code Execution via RSC
Summary
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency.
Severity
10 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
10 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 22:07 UTC
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
Vendor Product Version
calcom cal.diy Affected: 0 , < 5.9.9 (semver)
Unaffected: 5.9.9 (semver)
    cpe:2.3:a:cal:cal.com:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2025-12-07 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71389",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T22:07:00.836723Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T22:07:11.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cal.diy",
          "vendor": "calcom",
          "versions": [
            {
              "lessThan": "5.9.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.9.9",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cal:cal.com:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.9.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2025-12-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:48:14.200Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qjx2-5xqp-cpf4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/calcom/cal.diy/security/advisories/GHSA-qjx2-5xqp-cpf4"
        },
        {
          "name": "Patch (PR #25592)",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/calcom/cal.diy/pull/25592"
        },
        {
          "name": "Upstream Next.js advisory (CVE-2025-55182)",
          "tags": [
            "related"
          ],
          "url": "https://github.com/advisories/GHSA-9qr9-h5gf-34mp"
        },
        {
          "name": "VulnCheck Advisory: Cal.com before 5.9.9 Remote Code Execution via RSC",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cal-com-before-remote-code-execution-via-rsc"
        }
      ],
      "title": "Cal.com before 5.9.9 Remote Code Execution via RSC",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71389",
    "datePublished": "2026-07-23T21:16:44.870Z",
    "dateReserved": "2026-07-16T12:14:41.769Z",
    "dateUpdated": "2026-07-28T01:48:14.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design

Strategy: Refactoring

Refactor your program so that you do not have to dynamically generate code.

Mitigation
Architecture and Design
  • Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
  • Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
  • This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
  • Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Testing

Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Mitigation MIT-32
Operation

Strategy: Compilation or Build Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-32
Operation

Strategy: Environment Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation
Implementation

For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].

CAPEC-242: Code Injection

An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.

CAPEC-35: Leverage Executable Code in Non-Executable Files

An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list