[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":67,"FormattedDate_nAg3h2XsX6RqFnk1SOU1oGWRxFImjqdBQB8ia3aVnk":74,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":81,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":87,"$f17q7jdn7tll3p":94,"$f2r4b9phgo6bha":127,"finding-templates-{\"q\":\"\",\"page\":1}":129},[4,15,24,32,40,47],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":13,"variant":14,"campaign_id":6},"Office Hours #14","office-hours-14","[Live Office Hours, Wed Oct 28] Check, patch, prove: PHP2Shell and other critical CVEs","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_xbwerEx9QFSjfNWIHcjtHw",true,[11,12],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot","secondary",{"title":16,"slug":17,"text":18,"link":19,"external":9,"targets":20,"cta":22,"variant":14,"campaign_id":23},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[21],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan","See pricing options","php2shell-rce",{"title":25,"slug":26,"text":27,"link":28,"external":29,"targets":30,"cta":28,"variant":14,"campaign_id":23},"PHP2Shell & Node2Shell detection - pricing page","php2shell-rce-pricing","PHP2Shell & Node2Shell detection live in every paid plan (unlimited rescans for patch validation)",null,false,[31],"\u002Fpricing",{"title":33,"slug":34,"text":35,"link":19,"external":9,"targets":36,"cta":22,"variant":14,"campaign_id":34},"Node2Shell detection - Vuln DB homepage, product, CVE page","node2shell","🚨 Detect Node2Shell with any paid plan. Get proof now",[37,38,39],"\u002Fvulnerabilities-exploits","\u002Fproduct","\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",{"title":41,"slug":42,"text":43,"link":19,"external":9,"targets":44,"cta":46,"variant":14,"campaign_id":23},"PHP2Shell detection - NetScan on the NS page","php2shell-rce-netscan","🚨 Detect Node2Shell + PHP2Shell with NetScan (from $96\u002Fmo for 16 assets)",[45],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick NetScan",{"title":48,"slug":23,"text":49,"link":19,"external":9,"targets":50,"cta":22,"variant":14,"campaign_id":23},"PHP2Shell detection - top pages, pricing CTA","🚨 Detect Node2Shell + PHP2Shell with any paid plan. Get proof",[51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams",["Island",68],{"key":69,"params":70,"result":72},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":71},"{}",{"head":73},{},["Island",75],{"key":76,"params":77,"result":79},"FormattedDate_nAg3h2XsX6RqFnk1SOU1oGWRxFImjqdBQB8ia3aVnk",{"props":78},"{\"date\":1791358396,\"format\":\"MMMM dd, yyyy\"}",{"head":80},{},["Island",82],{"key":83,"params":84,"result":85},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":71},{"head":86},{},["Island",88],{"key":89,"params":90,"result":92},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":91},"{\"text-color\":\"gray\"}",{"head":93},{},{"count":95,"next":96,"previous":28,"results":97},17552,"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?page=2&page_size=1",[98],{"id":99,"detectable_with":100,"vuln_details":107,"vuln_id":124,"name":125,"published":126,"updated":28},29909,{"tool":101,"engine":104},{"id":102,"name":103},1,"Network Scanner",{"id":105,"name":106},2,"Nuclei",{"id":99,"epss_score":108,"epss_percentile":109,"in_cisa_catalog":29,"codename":28,"public_description":110,"description":28,"severity":111,"risk_description":112,"public_recommendation":113,"recommendation":28,"references":114,"cvssv3":118,"cve":119,"date":121,"software_type":28,"vendor":122,"product":123,"ptt_exploit_capabilities":28,"category":28},0.00275,0.19769,"NEX-Forms Express WP Form Builder plugin for WordPress before 9.2.3 is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin registers a wp_ajax_nopriv_submit_nex_form handler for form submissions. Array-type field values are processed through rest_sanitize_array(), which only reindexes the array and performs no HTML sanitization, so markup is stored verbatim. When an administrator views the submitted entries, the stored payload renders without esc_html() escaping and executes arbitrary JavaScript in the admin's browser. Scalar fields are not affected (they are passed through strip_tags()).","high","An unauthenticated attacker can inject persistent JavaScript that executes in an administrator's browser session when they view form entries, leading to admin session hijacking, rogue account creation, and full site takeover.","Update NEX-Forms Express WP Form Builder to 9.2.3 or later, which recursively sanitizes array field inputs (nf_recursive_sanitize).",[115,116,117],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-10525","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Fd1e191e6-ff5b-4cb8-9b12-8ae73cf0d2f0\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fnex-forms-express-wp-form-builder\u002F",8.8,[120],"CVE-2026-10525","2026-07-17T00:00:00Z","basix","nex-forms-express-wp-form-builder","NETSCAN-NUCLEI-CVE-CVE-2026-10525","NEX-Forms Express WP Form Builder \u003C 9.2.3 - Unauthenticated Stored XSS (CVE-2026-10525)","2026-10-27T00:00:00Z",{"count":128},210,{"count":95,"next":130,"previous":28,"results":131},"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?limit=25&page=2&search=",[132,155,178,197,212,233,241,261,281,304,324,347,371,394,416,439,455,475,498,519,541,572,593,615,638],{"id":133,"detectable_with":134,"vuln_details":137,"vuln_id":153,"name":154,"published":126,"updated":28},29913,{"tool":135,"engine":136},{"id":102,"name":103},{"id":105,"name":106},{"id":133,"codename":28,"description":28,"severity":138,"risk_description":139,"public_description":140,"public_recommendation":141,"recommendation":28,"references":142,"cvssv3":145,"epss_score":146,"epss_percentile":147,"cve":148,"in_cisa_catalog":29,"date":150,"software_type":28,"vendor":151,"product":152,"ptt_exploit_capabilities":28},"critical","The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","Huang Yaoshi Pharmaceutical Management Software up to 16.0 contains an unrestricted file upload caused by accepting .asp filenames in the UploadFile element of a SOAP request to \u002FXSDService.asmx, letting attackers upload arbitrary files, exploit requires sending a crafted SOAP request.","Update to the latest version or apply security patches that restrict file types and validate file uploads.",[143,144],"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-66fj-74pq-7rwx","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56829",10,0.00583,0.47599,[149],"CVE-2024-56829","2025-01-02T00:00:00Z","huangyaoshi","huang_yaoshi","NETSCAN-NUCLEI-CVE-CVE-2024-56829","Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload",{"id":156,"detectable_with":157,"vuln_details":160,"vuln_id":176,"name":177,"published":126,"updated":28},29916,{"tool":158,"engine":159},{"id":102,"name":103},{"id":105,"name":106},{"id":156,"codename":28,"description":28,"severity":161,"risk_description":162,"public_description":163,"public_recommendation":164,"recommendation":28,"references":165,"cvssv3":169,"epss_score":170,"epss_percentile":171,"cve":172,"in_cisa_catalog":29,"date":174,"software_type":28,"vendor":175,"product":175,"ptt_exploit_capabilities":28},"medium","Remote attackers can fetch arbitrary URLs, potentially accessing internal hosts and sensitive data.","YesWiki \u003C 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of [[|URL]] wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication.","Update to version 4.7.0 or later.",[166,167,168],"https:\u002F\u002Fgithub.com\u002FYesWiki\u002Fyeswiki\u002Fsecurity\u002Fadvisories\u002FGHSA-x9j5-r988-9jcc","https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fyeswiki-before-4.7.0-unauthenticated-ssrf-via-url-raw-inclusion-syntax","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116205",5.3,0.00237,0.1456,[173],"CVE-2026-116205","2026-10-25T00:00:00Z","yeswiki","NETSCAN-NUCLEI-CVE-CVE-2026-116205","YesWiki \u003C 4.7.0 - Unauthenticated Server-Side Request Forgery",{"id":179,"detectable_with":180,"vuln_details":183,"vuln_id":195,"name":196,"published":126,"updated":28},29914,{"tool":181,"engine":182},{"id":102,"name":103},{"id":105,"name":106},{"id":179,"codename":28,"description":28,"severity":138,"risk_description":184,"public_description":185,"public_recommendation":186,"recommendation":28,"references":187,"cvssv3":191,"epss_score":28,"epss_percentile":28,"cve":192,"in_cisa_catalog":29,"date":194,"software_type":28,"vendor":28,"product":28,"ptt_exploit_capabilities":28},"Unauthenticated attackers can modify server environment, lock out operators, cause SSRF, and trigger redeployment, severely impacting server integrity and availability.","danmu_api before 1.21.7 contains an authentication bypass caused by default TOKEN usage and unset ADMIN_TOKEN, letting unauthenticated attackers modify server environment configuration via specific API endpoints, exploit requires default token configuration.","Update to version 1.21.7 or later.",[188,189,190],"https:\u002F\u002Fgithub.com\u002Fhuangxd-\u002Fdanmu_api\u002Fcommit\u002F6e93478064a0ce4e7ed3bc2eae88adaad1b7ab02","https:\u002F\u002Fgithub.com\u002Fhuangxd-\u002Fdanmu_api","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116485",9.8,[193],"CVE-2026-116485","2026-10-26T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-116485","danmu_api - Unauthenticated Access to Admin API via Default Token",{"id":198,"detectable_with":199,"vuln_details":202,"vuln_id":210,"name":211,"published":126,"updated":28},29910,{"tool":200,"engine":201},{"id":102,"name":103},{"id":105,"name":106},{"id":198,"codename":28,"description":28,"severity":161,"risk_description":203,"public_description":204,"public_recommendation":205,"recommendation":28,"references":206,"cvssv3":28,"epss_score":28,"epss_percentile":28,"cve":28,"in_cisa_catalog":29,"date":28,"software_type":28,"vendor":208,"product":209,"ptt_exploit_capabilities":28},"The risk exists that the data is unknowingly exposed to the internet, making it accessible to remote threat actors that can leverage it to attack the target, or the entire company, depending on the sensitivity of the data.","Detects if the config page of the Lighter server is exposed, it is an opensource REST application for interacting with Apache Spark on Kubernetes or Apache Hadoop YARN.","We suggest restricting access to the exposed resource.",[207],"https:\u002F\u002Fgithub.com\u002Fexacaster\u002Flighter","exacaster","lighter","NETSCAN-NUCLEI-EXPOSURES-LIGHTER-CONFIG","Lighter - Config Exposed",{"id":213,"detectable_with":214,"vuln_details":217,"vuln_id":231,"name":232,"published":126,"updated":28},29911,{"tool":215,"engine":216},{"id":102,"name":103},{"id":105,"name":106},{"id":213,"codename":28,"description":28,"severity":138,"risk_description":218,"public_description":219,"public_recommendation":220,"recommendation":28,"references":221,"cvssv3":145,"epss_score":224,"epss_percentile":225,"cve":226,"in_cisa_catalog":29,"date":228,"software_type":28,"vendor":229,"product":230,"ptt_exploit_capabilities":28},"Unauthenticated attackers can overwrite arbitrary files, including .htaccess, potentially breaking the site and disabling security measures.","W3 Total Cache WordPress plugin \u003C 2.10.5 contains an unrestricted file write vulnerability caused by improper validation of request paths used for cache file names, letting unauthenticated attackers overwrite files including .htaccess, exploit requires no authentication.","Upgrade to version 2.10.5 or later.",[222,223],"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-18051","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Fdc56cdd2-419b-4a64-9d2a-29dc7e79cb6d\u002F",0.00572,0.47044,[227],"CVE-2026-18051","2026-08-19T00:00:00Z","boldgrid","w3-total-cache","NETSCAN-NUCLEI-CVE-CVE-2026-18051","W3 Total Cache \u003C 2.10.5 - Unauthenticated Arbitrary Directory File Write",{"id":99,"detectable_with":234,"vuln_details":237,"vuln_id":124,"name":240,"published":126,"updated":28},{"tool":235,"engine":236},{"id":102,"name":103},{"id":105,"name":106},{"id":99,"codename":28,"description":28,"severity":111,"risk_description":112,"public_description":110,"public_recommendation":113,"recommendation":28,"references":238,"cvssv3":118,"epss_score":108,"epss_percentile":109,"cve":239,"in_cisa_catalog":29,"date":121,"software_type":28,"vendor":122,"product":123,"ptt_exploit_capabilities":28},[115,116,117],[120],"NEX-Forms Express WP Form Builder \u003C 9.2.3 - Unauthenticated Stored XSS",{"id":242,"detectable_with":243,"vuln_details":246,"vuln_id":259,"name":260,"published":126,"updated":28},29915,{"tool":244,"engine":245},{"id":102,"name":103},{"id":105,"name":106},{"id":242,"codename":28,"description":28,"severity":138,"risk_description":247,"public_description":248,"public_recommendation":249,"recommendation":28,"references":250,"cvssv3":254,"epss_score":255,"epss_percentile":256,"cve":257,"in_cisa_catalog":29,"date":174,"software_type":28,"vendor":28,"product":28,"ptt_exploit_capabilities":28},"Remote attackers can bypass authentication, potentially gaining unauthorized access to the system.","ruoyi-vue-pro (Yudao) ships base configuration yudao.sms-code.begin-code=end-code=9999, so every generated SMS verification code is the constant \"9999\" in all profiles. The anonymous SMS-login flow therefore grants an access token to any account whose mobile number is known: send-sms-code followed by sms-login with code 9999 issues a full token, including for the seeded super administrator account (mobile 18818260272 in the shipped SQL). No CAPTCHA hook exists for scene=21 in any profile.","Update to the latest version.",[251,252,253],"https:\u002F\u002Fgist.github.com\u002FFulucky0-yuri\u002F1ad8a1f166af7cb85c498473753a8636","https:\u002F\u002Fgithub.com\u002FYunaiV\u002Fruoyi-vue-pro","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116006",9.2,0.00384,0.3219,[258],"CVE-2026-116006","NETSCAN-NUCLEI-CVE-CVE-2026-116006","Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code",{"id":262,"detectable_with":263,"vuln_details":266,"vuln_id":279,"name":280,"published":126,"updated":28},29912,{"tool":264,"engine":265},{"id":102,"name":103},{"id":105,"name":106},{"id":262,"codename":28,"description":28,"severity":138,"risk_description":139,"public_description":267,"public_recommendation":268,"recommendation":28,"references":269,"cvssv3":145,"epss_score":272,"epss_percentile":273,"cve":274,"in_cisa_catalog":9,"date":276,"software_type":28,"vendor":277,"product":278,"ptt_exploit_capabilities":28},"Ahsay AhsayCBS \u003C= 10.3.2 contains a command injection caused by manipulation of the \\\"random\\\" argument in \u002Frps\u002Fapi\u002Fjson\u002FUpdateReceivers.do of Replication Receiver, letting remote attackers execute OS commands, exploit requires crafted request","Upgrade to version 10.3.4.",[270,271],"https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fattack-blogs\u002Fahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-105134",0.86266,0.99731,[275],"CVE-2026-105134","2026-10-04T00:00:00Z","ahsay","ahsaycbs","NETSCAN-NUCLEI-CVE-CVE-2026-105134","AhsayCBS \u003C= 10.3.4 - Unauthenticated RCE",{"id":282,"detectable_with":283,"vuln_details":286,"vuln_id":302,"name":303,"published":194,"updated":28},29907,{"tool":284,"engine":285},{"id":102,"name":103},{"id":105,"name":106},{"id":282,"codename":28,"description":28,"severity":111,"risk_description":287,"public_description":288,"public_recommendation":289,"recommendation":28,"references":290,"cvssv3":295,"epss_score":296,"epss_percentile":297,"cve":298,"in_cisa_catalog":29,"date":174,"software_type":28,"vendor":300,"product":301,"ptt_exploit_capabilities":28},"The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.","Paisa \u003C 0.7.8 contains a path traversal vulnerability caused by improper sanitization of file names in GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers, letting unauthenticated attackers read arbitrary files and delete backups via ..\u002F sequences.","Update to version 0.7.8 or later.",[291,292,293,294],"https:\u002F\u002Fgithub.com\u002Fananthakumaran\u002Fpaisa\u002Fissues\u002F420","https:\u002F\u002Fgithub.com\u002Fananthakumaran\u002Fpaisa\u002Fcommit\u002F035949351f7c0d0f90ecf767aa1e28b4d5a0ae31","https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fpaisa-before-0.7.8-path-traversal-via-editor-and-sheet-api","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116067",7.5,0.00509,0.43189,[299],"CVE-2026-116067","ananthakumaran","paisa","NETSCAN-NUCLEI-CVE-CVE-2026-116067","Paisa \u003C 0.7.8 - Unauthenticated Path Traversal",{"id":305,"detectable_with":306,"vuln_details":309,"vuln_id":322,"name":323,"published":194,"updated":28},29904,{"tool":307,"engine":308},{"id":102,"name":103},{"id":105,"name":106},{"id":305,"codename":28,"description":28,"severity":138,"risk_description":139,"public_description":310,"public_recommendation":311,"recommendation":28,"references":312,"cvssv3":191,"epss_score":315,"epss_percentile":316,"cve":317,"in_cisa_catalog":29,"date":319,"software_type":28,"vendor":320,"product":321,"ptt_exploit_capabilities":28},"Rejetto HTTP File Server (HFS) 2.4.x inserts the multipart upload filename into the server-side template symbol map as %item-resource% without escaping. A filename containing the literal %item-resource% is substituted a second time by the sequential global replacement in xtpl(), allowing a :} sequence to terminate the quoting region so a following {.exec|...} macro is executed as an operating-system command. An unauthenticated attacker achieves remote code execution with a single request.","Update to a version later than 2.4.0 or the latest available version.",[313,314],"https:\u002F\u002Fgithub.com\u002Fwgetnz\u002Fhfs2\u002Fblob\u002Fmaster\u002Fadvisories\u002Fhfs2-upload-filename-template-injection\u002FREADME.md","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97359",0.01411,0.72481,[318],"CVE-2026-97359","2026-09-24T00:00:00Z","rejetto","http_file_server","NETSCAN-NUCLEI-CVE-CVE-2026-97359","Rejetto HTTP File Server 2.4.x - Template Injection",{"id":325,"detectable_with":326,"vuln_details":329,"vuln_id":345,"name":346,"published":194,"updated":28},29908,{"tool":327,"engine":328},{"id":102,"name":103},{"id":105,"name":106},{"id":325,"codename":28,"description":28,"severity":161,"risk_description":330,"public_description":331,"public_recommendation":332,"recommendation":28,"references":333,"cvssv3":337,"epss_score":338,"epss_percentile":339,"cve":340,"in_cisa_catalog":29,"date":342,"software_type":28,"vendor":343,"product":344,"ptt_exploit_capabilities":28},"Authenticated attackers can execute arbitrary SQL commands, potentially leading to information disclosure, data modification or deletion.","The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role and above to perform SQL injection.","Upgrade to version 3.40 or later.",[334,335,336],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F7b13e3d3-42ee-4fe2-bb47-75bd2273f1b0\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fmedia-library-assistant\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-16959",6.8,0.00391,0.32995,[341],"CVE-2026-16959","2026-08-21T00:00:00Z","david-lingren","media-library-assistant","NETSCAN-NUCLEI-CVE-CVE-2026-16959","WordPress Media Library Assistant \u003C 3.40 - SQL Injection",{"id":348,"detectable_with":349,"vuln_details":352,"vuln_id":369,"name":370,"published":194,"updated":28},29903,{"tool":350,"engine":351},{"id":102,"name":103},{"id":105,"name":106},{"id":348,"codename":28,"description":28,"severity":111,"risk_description":353,"public_description":354,"public_recommendation":355,"recommendation":28,"references":356,"cvssv3":361,"epss_score":362,"epss_percentile":363,"cve":364,"in_cisa_catalog":29,"date":366,"software_type":28,"vendor":367,"product":368,"ptt_exploit_capabilities":28},"Any website can bypass the server's CORS allowlist and make credentialed cross-origin requests to the local native-server, enabling unauthorized use of the exposed browser-automation tools (navigation, script execution, cookie\u002Fsession access, screenshots) from any open browser tab.","mcp-chrome-bridge \u003C=1.0.31 uses origin.startsWith for CORS, so origins like http:\u002F\u002F127.0.0.1.evil.com are wrongly allowed, letting attackers bypass CORS and access the local server.","Update to the latest version beyond 1.0.31.",[357,358,359,360],"https:\u002F\u002Fgithub.com\u002Fhangwin\u002Fmcp-chrome\u002Fissues\u002F384","https:\u002F\u002Fgithub.com\u002Fhangwin\u002Fmcp-chrome\u002Fpull\u002F383","https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fmcp-chrome-bridge-through-1.0.31-cors-origin-bypass","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102878",8.1,0.00235,0.14308,[365],"CVE-2026-102878","2026-09-29T00:00:00Z","hangwin","mcp-chrome-bridge","NETSCAN-NUCLEI-CVE-CVE-2026-102878","mcp-chrome-bridge (hangwin\u002Fmcp-chrome) \u003C= 1.0.31 - CORS Origin Bypass (CSWSH)",{"id":372,"detectable_with":373,"vuln_details":376,"vuln_id":392,"name":393,"published":194,"updated":28},29905,{"tool":374,"engine":375},{"id":102,"name":103},{"id":105,"name":106},{"id":372,"codename":28,"description":28,"severity":111,"risk_description":377,"public_description":378,"public_recommendation":379,"recommendation":28,"references":380,"cvssv3":385,"epss_score":386,"epss_percentile":387,"cve":388,"in_cisa_catalog":29,"date":390,"software_type":28,"vendor":391,"product":391,"ptt_exploit_capabilities":28},"An unauthenticated attacker can store JavaScript in WordPress comments that executes automatically (zero-click) in every visitor's browser on affected pages.","WordPress core before 7.1.1 is vulnerable to unauthenticated stored XSS via crafted blockquote comments. wp_kses_post accepts a \u003Cblockquote> with a literal newline in the cite attribute, wpautop's non-quote-aware regex injects a \u003Cp> inside the cite value, and wptexturize leaves the attribute open so onfocus\u002Fautofocus land on \u003Ccode> as real HTML attributes, giving zero-click stored XSS. Only triggers when comments are open and auto-approved.","Update WordPress to 7.1.1 or a backport release (7.0.5+, 6.9.8+, 6.8.9+, down to 4.7.36+), which makes wpautop's blockquote regex quote-aware.",[381,382,383,384],"https:\u002F\u002Fwordpress.org\u002Fnews\u002F2026\u002F09\u002Fwordpress-7-1-1-maintenance-and-security-release\u002F","https:\u002F\u002Fgithub.com\u002F686f6c61\u002FPOC-WP-CORE-CVE-2026-93485","https:\u002F\u002Fgithub.com\u002FDeathShotXD\u002FComment2Shell","https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-93485",7.1,0.00354,0.28798,[389],"CVE-2026-93485","2026-09-18T00:00:00Z","wordpress","NETSCAN-NUCLEI-CVE-CVE-2026-93485","WordPress Core \u003C 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell)",{"id":395,"detectable_with":396,"vuln_details":399,"vuln_id":414,"name":415,"published":194,"updated":28},29906,{"tool":397,"engine":398},{"id":102,"name":103},{"id":105,"name":106},{"id":395,"codename":28,"description":28,"severity":111,"risk_description":400,"public_description":401,"public_recommendation":402,"recommendation":28,"references":403,"cvssv3":118,"epss_score":407,"epss_percentile":408,"cve":409,"in_cisa_catalog":29,"date":411,"software_type":28,"vendor":412,"product":413,"ptt_exploit_capabilities":28},"Authenticated attackers with Subscriber-level privileges can disclose local files, including configuration files that contain database credentials and authentication keys.","The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory.","Update to version 6.9.1 or later.",[404,405,406],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F096cb7df-26a5-4f5f-bbec-725e063a2b75\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-17540","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Ffile-manager\u002F",0.00424,0.36466,[410],"CVE-2026-17540","2026-08-10T00:00:00Z","bit-apps","file-manager","NETSCAN-NUCLEI-CVE-CVE-2026-17540","WordPress Bit File Manager \u003C 6.9.1 - Arbitrary File Read",{"id":417,"detectable_with":418,"vuln_details":421,"vuln_id":437,"name":438,"published":194,"updated":28},29901,{"tool":419,"engine":420},{"id":102,"name":103},{"id":105,"name":106},{"id":417,"codename":28,"description":28,"severity":422,"risk_description":287,"public_description":423,"public_recommendation":424,"recommendation":28,"references":425,"cvssv3":429,"epss_score":430,"epss_percentile":431,"cve":432,"in_cisa_catalog":29,"date":434,"software_type":28,"vendor":435,"product":436,"ptt_exploit_capabilities":28},"low","The Agile Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server.","Update to version 1.6.9 or later.",[426,427,428],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F14014b6b-ce49-4778-822c-026ecafa1772\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fagile-store-locator\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9062",3.4,0.00248,0.15991,[433],"CVE-2026-9062","2026-06-13T00:00:00Z","agile-logix","agile-store-locator","NETSCAN-NUCLEI-CVE-CVE-2026-9062","WordPress Agile Store Locator \u003C 1.6.9 - Arbitrary File Read",{"id":440,"detectable_with":441,"vuln_details":444,"vuln_id":453,"name":454,"published":194,"updated":28},29899,{"tool":442,"engine":443},{"id":102,"name":103},{"id":105,"name":106},{"id":440,"codename":28,"description":28,"severity":161,"risk_description":445,"public_description":446,"public_recommendation":447,"recommendation":28,"references":448,"cvssv3":28,"epss_score":28,"epss_percentile":28,"cve":28,"in_cisa_catalog":29,"date":28,"software_type":28,"vendor":451,"product":452,"ptt_exploit_capabilities":28},"The risk exists that an attacker can use the vulnerability identified to perform further attacks on the server.","WordPress Jetpack plugin before 16.1.3 does not sanitize the comment_author parameter before outputting it in the Reader editor, allowing a reflected cross-site scripting attack against an administrator who opens a crafted link.","We recommend reviewing the purpose of the application or the server and applying patches, if applicable.",[449,450],"https:\u002F\u002Fjetpack.com\u002Fresources\u002Fjetpack-16-1-3-critical-security-update\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fjetpack\u002F","automattic","jetpack","NETSCAN-NUCLEI-VULNERABILITIES-JETPACK-READER-XSS","WordPress Jetpack \u003C 16.1.3 - Reflected Cross-Site Scripting",{"id":456,"detectable_with":457,"vuln_details":460,"vuln_id":473,"name":474,"published":194,"updated":28},29902,{"tool":458,"engine":459},{"id":102,"name":103},{"id":105,"name":106},{"id":456,"codename":28,"description":28,"severity":111,"risk_description":461,"public_description":462,"public_recommendation":463,"recommendation":28,"references":464,"cvssv3":295,"epss_score":467,"epss_percentile":468,"cve":469,"in_cisa_catalog":29,"date":434,"software_type":28,"vendor":471,"product":472,"ptt_exploit_capabilities":28},"Unauthenticated attackers can extract sensitive database information via SQL injection, potentially compromising the entire database.","WP Ticket (wp-ticket) for WordPress through 6.0.4 allows unauthenticated SQL injection via front-end search due to unsanitized use of the \"s\" parameter in emd_author_search_results(). Exploitation requires at least one guest ticket. Fixed in 6.0.5.","Update WP Ticket plugin to a version later than 6.0.4 or the latest available version.",[465,466],"https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-ticket\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9848",0.00655,0.511,[470],"CVE-2026-9848","emarket-design","wp-ticket","NETSCAN-NUCLEI-CVE-CVE-2026-9848","WP Ticket \u003C= 6.0.4 - SQL Injection",{"id":476,"detectable_with":477,"vuln_details":480,"vuln_id":496,"name":497,"published":194,"updated":28},29900,{"tool":478,"engine":479},{"id":102,"name":103},{"id":105,"name":106},{"id":476,"codename":28,"description":28,"severity":138,"risk_description":481,"public_description":482,"public_recommendation":483,"recommendation":28,"references":484,"cvssv3":488,"epss_score":489,"epss_percentile":490,"cve":491,"in_cisa_catalog":29,"date":493,"software_type":28,"vendor":494,"product":495,"ptt_exploit_capabilities":28},"An unauthenticated attacker can reach internal-only services and cloud metadata endpoints through the server, with partial responses leaked via job error messages.","LocalAI before 4.6.0 is affected by an unauthenticated server-side request forgery vulnerability in the POST \u002Fmodels\u002Fapply endpoint. The gallery `url` field is passed to the gallery config fetcher without validation, allowing an unauthenticated attacker to make the server issue HTTP requests to arbitrary internal, loopback, link-local, and cloud-metadata addresses. The outcome of the server-side fetch is reflected in the model-apply job status.","Upgrade to LocalAI 4.6.0 or later, which validates gallery config URLs and rejects requests to internal network addresses.",[485,486,487],"https:\u002F\u002Fgithub.com\u002Fmudler\u002FLocalAI\u002Fissues\u002F10665","https:\u002F\u002Fgithub.com\u002Fmudler\u002FLocalAI\u002Fcommit\u002F2cbb3c96b34d","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59707",9.3,0.00458,0.39438,[492],"CVE-2026-59707","2026-07-07T00:00:00Z","mudler","localai","NETSCAN-NUCLEI-CVE-CVE-2026-59707","LocalAI \u003C 4.6.0 - Server-Side Request Forgery",{"id":499,"detectable_with":500,"vuln_details":503,"vuln_id":517,"name":518,"published":194,"updated":28},29898,{"tool":501,"engine":502},{"id":102,"name":103},{"id":105,"name":106},{"id":499,"codename":28,"description":28,"severity":111,"risk_description":400,"public_description":504,"public_recommendation":505,"recommendation":28,"references":506,"cvssv3":510,"epss_score":511,"epss_percentile":512,"cve":513,"in_cisa_catalog":29,"date":228,"software_type":28,"vendor":515,"product":516,"ptt_exploit_capabilities":28},"The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server.","Update to version 5.4.13 or later.",[507,508,509],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F5e03858d-db0b-4b65-99cc-eb01ad4195e9\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-11565","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Ffile-manager-advanced\u002F",8.5,0.00323,0.25064,[514],"CVE-2026-11565","saad-iqbal","file-manager-advanced","NETSCAN-NUCLEI-CVE-CVE-2026-11565","WordPress Advanced File Manager \u003C 5.4.13 - Arbitrary File Read",{"id":520,"detectable_with":521,"vuln_details":524,"vuln_id":539,"name":540,"published":194,"updated":28},29897,{"tool":522,"engine":523},{"id":102,"name":103},{"id":105,"name":106},{"id":520,"codename":28,"description":28,"severity":138,"risk_description":525,"public_description":526,"public_recommendation":527,"recommendation":28,"references":528,"cvssv3":488,"epss_score":532,"epss_percentile":533,"cve":534,"in_cisa_catalog":29,"date":536,"software_type":28,"vendor":537,"product":538,"ptt_exploit_capabilities":28},"Unauthenticated attackers can read arbitrary database contents, including Joomla user credentials (usernames, emails, password hashes), session data and membership records, enabling further compromise of the site.","OrdaSoft Simple Membership (com_simplemembership) for Joomla before 7.4.0 is vulnerable to unauthenticated SQL injection via the 'login' parameter of the checkLoginPass task (site\u002Fsimplemembership.php). The handler passes the value through Joomla's generic input filter, which strips HTML but leaves quotes and SQL syntax intact, and concatenates it directly into the SQL query with no escaping or parameter binding. Error-based injection via extractvalue() lets unauthenticated attackers exfiltrate database contents.","Update OrdaSoft Simple Membership to version 7.4.0 or later.",[529,530,531],"https:\u002F\u002Fgithub.com\u002Fmurrez\u002FCVE-2026-102782","https:\u002F\u002Fpocbit.org\u002Fpocs\u002Fcve-2026-102782","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102782",0.00338,0.27001,[535],"CVE-2026-102782","2026-10-07T00:00:00Z","ordasoft","simple_membership","NETSCAN-NUCLEI-CVE-CVE-2026-102782","OrdaSoft Simple Membership \u003C 7.4.0 - SQL Injection",{"id":542,"detectable_with":543,"vuln_details":546,"vuln_id":570,"name":571,"published":174,"updated":28},29896,{"tool":544,"engine":545},{"id":102,"name":103},{"id":105,"name":106},{"id":542,"codename":547,"description":28,"severity":138,"risk_description":548,"public_description":549,"public_recommendation":550,"recommendation":28,"references":551,"cvssv3":254,"epss_score":563,"epss_percentile":564,"cve":565,"in_cisa_catalog":29,"date":567,"software_type":28,"vendor":568,"product":569,"ptt_exploit_capabilities":28},"Node2Shell\u002FHTTP2Shell","An unauthenticated attacker who can send Brotli-compressed request bodies to the application or proxy, or make it fetch Brotli-compressed responses from a server they control, can corrupt process memory and potentially run code with the privileges of the Node.js, Bun or Envoy process. A probe match means the endpoint decoded a Brotli request body with a vulnerable decoder; it does not execute code. A Node.js or Bun version match is based on the version the application discloses and does not confirm that a Brotli decoding path is reachable. Endpoints that decode Brotli request bodies receive an upload of about 23 MB. A reachable Envoy admin API is a separate exposure in its own right, because it leaks the full proxy configuration and allows runtime changes.","The Google Brotli decoder versions 1.0.3 to 1.0.9, 1.1.0 and 1.2.0, bundled in Node.js versions 10.16.0 and later prior to 22.23.4, 24.22.1 and 26.12.1, in Bun versions prior to 1.4.4, and in Envoy Proxy versions prior to 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0, contains an out-of-bounds write. End-of-life Node.js lines, such as 20.x, 23.x and 25.x, receive no fix. Crafted Brotli-compressed data can corrupt memory, leading to crashes, memory disclosure or remote code execution. Node.js applications are reachable through Brotli request-body parsing (for example Express 5 with body-parser 2) and through server-side HTTP clients such as fetch() that decode Brotli responses. Envoy, and Istio through its sidecars, is only exposed when an HTTP decompressor filter uses the Brotli library. The main check is a differential probe. It learns the endpoint's normal and malformed-Brotli response classes with four one-byte POST requests, which every target receives. Only endpoints that decode Brotli request bodies then receive a 23 MB Brotli stream, which a patched decoder rejects as malformed and a vulnerable decoder accepts, followed by a final one-byte request. If the probe is inconclusive, the template falls back to version checks. It reads the Envoy version from the exposed admin API (\u002Fserver_info) and confirms through \u002Fconfig_dump that a Brotli decompressor is configured, or reads a Node.js or Bun version disclosed in response headers or in a health, status or version endpoint.","Upgrade Node.js to 22.23.4, 24.22.1, 26.12.1 or later and rebuild container images that bundle the runtime. Move applications on an end-of-life Node.js line (20.x or older, 23.x or 25.x) to a supported line, because those releases receive no fix. Upgrade Bun to 1.4.4 or later. Upgrade Envoy Proxy to 1.40.0, 1.39.3, 1.38.6, 1.37.8 or later in the same supported branch (1.36.12 also contains the fix, but 1.36 is unsupported), and Istio to 1.29.9, 1.30.6, 1.31.2 or later. Until you can patch, reject Content-Encoding br request bodies before any parser decodes them, disable Brotli decoding in server-side HTTP clients, and disable the Envoy Brotli decompressor filter for both directions. Bind the Envoy admin interface to localhost or a management network, and stop disclosing the Node.js or Bun version in response headers and public health or status endpoints.",[552,553,554,555,556,557,558,559,560,561,562],"https:\u002F\u002Fpatchtheplanet.org\u002Fbrotli","https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Foctober-2026-security-releases","https:\u002F\u002Fbun.com\u002Fblog\u002Fbun-v1.4.4","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111497","https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-111497","https:\u002F\u002Fgithub.com\u002Fenvoyproxy\u002Fenvoy\u002Freleases","https:\u002F\u002Fgithub.com\u002Fenvoyproxy\u002Fenvoy\u002Freleases\u002Ftag\u002Fv1.36.12","https:\u002F\u002Fistio.io\u002Flatest\u002Fnews\u002Fsecurity\u002Fistio-security-2026-007\u002F","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fbrotli\u002Freleases\u002Ftag\u002Fv1.2.1","https:\u002F\u002Fwww.imperva.com\u002Fblog\u002Fnode2shell-from-brotli-data-to-remote-code-execution\u002F","https:\u002F\u002Fgithub.com\u002Fjfrog\u002Fvulnerability_scanners\u002Ftree\u002Fmain\u002Fbrotli2shell_cve_2026_111497",0.36027,0.98463,[566],"CVE-2026-111497","2026-10-24T00:00:00Z","nodejs","node.js","NETSCAN-NUCLEI-CVE-CVE-2026-111497","Node2Shell\u002FHTTP2Shell - Brotli Decoder Remote Code Execution",{"id":573,"detectable_with":574,"vuln_details":577,"vuln_id":591,"name":592,"published":174,"updated":28},29895,{"tool":575,"engine":576},{"id":102,"name":103},{"id":105,"name":106},{"id":573,"codename":28,"description":28,"severity":111,"risk_description":578,"public_description":579,"public_recommendation":580,"recommendation":28,"references":581,"cvssv3":295,"epss_score":584,"epss_percentile":585,"cve":586,"in_cisa_catalog":9,"date":588,"software_type":28,"vendor":589,"product":590,"ptt_exploit_capabilities":28},"Attackers can retrieve sensitive information by bypassing access controls, leading to information disclosure.","Red Hat JBoss Enterprise Application Platform (EAP) can expose the Web Console, JMX Console, and JMXInvokerServlet without authentication, allowing remote attackers to reach admin dashboards and interact with MBeans, leading to full server compromise.","Restrict access to \u002Fweb-console, \u002Fjmx-console and \u002Finvoker, and enforce authentication on the JBoss management interfaces.",[582,583],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2010-1428","https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2010-1428",0.52654,0.98961,[587],"CVE-2010-1428","2010-04-28T00:00:00Z","redhat","jboss_enterprise_application_platform","NETSCAN-NUCLEI-CVE-CVE-2010-1428","Red Hat JBoss - Web\u002FJMX Console Access",{"id":594,"detectable_with":595,"vuln_details":598,"vuln_id":613,"name":614,"published":567,"updated":28},29889,{"tool":596,"engine":597},{"id":102,"name":103},{"id":105,"name":106},{"id":594,"codename":28,"description":28,"severity":138,"risk_description":599,"public_description":600,"public_recommendation":601,"recommendation":28,"references":602,"cvssv3":191,"epss_score":607,"epss_percentile":608,"cve":609,"in_cisa_catalog":29,"date":611,"software_type":28,"vendor":612,"product":612,"ptt_exploit_capabilities":28},"Complete unauthenticated account takeover of any user (including network administrators) on WordPress multisite installations running Theme My Login \u003C= 7.2.1 with tml_user_passwords enabled.","Theme My Login (TML) \u003C= 7.2.1 for WordPress is vulnerable to unauthenticated account takeover on multisite installations. The multisite-only filter tml_ms_filter_pre_insert_user_data(), hooked on wp_pre_insert_user_data, hashes and injects $_POST['user_pass1'] into the user record whenever the tml_user_passwords network option is enabled, WITHOUT checking the $update flag. During a lost password request (wp-login.php?action=lostpassword -> retrieve_password() -> wp_update_user()), this filter fires on the EXISTING target user, overwriting their password with an attacker-chosen value. An unauthenticated attacker can therefore take over any account, including a network administrator, by sending user_pass1 in the lost-password POST. Fixed in 7.2.2 (changeset 3696081 \u002F commit 06b76231) by adding the $update guard and only applying the password during activation.","Update Theme My Login to 7.2.2 or later. As mitigation, disable the tml_user_passwords network option until patched.",[603,604,605,606],"https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Ftheme-my-login\u002Fvulnerability\u002Fwordpress-theme-my-login-plugin-7-2-1-unauthenticated-privilege-escalation-vulnerability","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset\u002F3696081\u002Ftheme-my-login","https:\u002F\u002Fgithub.com\u002Ftheme-my-login\u002Ftheme-my-login\u002Fcommit\u002F06b76231b86150eed932db52646734486ecd0781","https:\u002F\u002Fcve.mitre.org\u002Fcgi-bin\u002Fcvename.cgi?name=CVE-2026-89079",0.01631,0.76055,[610],"CVE-2026-89079","2026-10-16T00:00:00Z","theme-my-login","NETSCAN-NUCLEI-CVE-CVE-2026-89079","Theme My Login \u003C= 7.2.1 - Privilege Escalation",{"id":616,"detectable_with":617,"vuln_details":620,"vuln_id":636,"name":637,"published":567,"updated":28},29894,{"tool":618,"engine":619},{"id":102,"name":103},{"id":105,"name":106},{"id":616,"codename":28,"description":28,"severity":138,"risk_description":621,"public_description":622,"public_recommendation":623,"recommendation":28,"references":624,"cvssv3":488,"epss_score":629,"epss_percentile":630,"cve":631,"in_cisa_catalog":29,"date":633,"software_type":28,"vendor":634,"product":635,"ptt_exploit_capabilities":28},"Unauthenticated attackers can execute arbitrary OS commands as the Asterisk user, potentially compromising the system.","Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after rejecting an unrelated key.","Update to the version after commit b97dbaf or latest available version.",[625,626,627,628],"https:\u002F\u002Fgithub.com\u002FIssabelFoundation\u002Fframework\u002Fcommit\u002Fb97dbaf0b71c1c36f841e672b664afbeb02773bd","https:\u002F\u002Fgithub.com\u002FIssabelFoundation\u002Ffirstboot\u002Fcommit\u002F74b28cab9a35","https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fissabel-pbx-hard-coded-jwt-key-rce-via-pbxapi-manager-originate","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-89026",0.02699,0.85822,[632],"CVE-2026-89026","2026-09-15T00:00:00Z","issabel","framework","NETSCAN-NUCLEI-CVE-CVE-2026-89026","Issabel Framework - Hard-Coded PBX API JWT Key",{"id":639,"detectable_with":640,"vuln_details":643,"vuln_id":658,"name":659,"published":567,"updated":28},29893,{"tool":641,"engine":642},{"id":102,"name":103},{"id":105,"name":106},{"id":639,"codename":28,"description":28,"severity":111,"risk_description":644,"public_description":645,"public_recommendation":646,"recommendation":28,"references":647,"cvssv3":361,"epss_score":651,"epss_percentile":652,"cve":653,"in_cisa_catalog":29,"date":655,"software_type":28,"vendor":656,"product":657,"ptt_exploit_capabilities":28},"Unauthenticated arbitrary file write into a web-accessible directory under the site origin. This enables planting attacker-controlled content (HTML\u002FSVG leading to stored XSS, phishing pages, .htaccess where AllowOverride permits). Where the web server maps a surviving executable extension (e.g. .pht, .phar, .phtml) to the PHP handler, it escalates to remote code execution; note that Contact Form 7 core runs wpcf7_antiscript_file_name() first and rewrites php\u002Fphtml\u002Fpl\u002Fpy\u002Frb\u002Fcgi\u002Fasp\u002Faspx uploads to a harmless *.\u003Cext>_.txt, so a plain .php name does not execute on a default install.","Ultimate Addons for Contact Form 7 (UACF7) \u003C= 3.5.50 copies every file submitted through a Contact Form 7 [uacf7_signature] field into wp-content\u002Fuploads\u002Fuacf7-uploads\u002F with no file-type or extension validation when the PDF Generator module is enabled on the form. An unauthenticated attacker can POST to the public CF7 REST feedback endpoint and write an arbitrary file of any extension into the webroot (CWE-434). The written file is directly retrievable without authentication. The copy sink is addons\u002Fpdf-generator\u002Fpdf-generator.php, which stores the file as \"{time()}-{field_name}-{sanitize_file_name(basename)}\". Fixed in 3.5.51, which adds uacf7_is_safe_uploaded_file() with a MIME\u002Fextension allowlist.","Update Ultimate Addons for Contact Form 7 to 3.5.51 or later. As mitigation, disable the PDF Generator module and deny script execution and direct access in wp-content\u002Fuploads\u002F.",[648,649,650],"https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Fultimate-addons-for-contact-form-7\u002Fvulnerability\u002Fwordpress-ultra-addons-for-contact-form-7-plugin-3-2-4-3-5-50-unauthenticated-arbitrary-file-upload-vulnerability","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fultimate-addons-for-contact-form-7\u002Ftags\u002F3.5.48\u002Faddons\u002Fpdf-generator\u002Fpdf-generator.php","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82901",0.04328,0.91119,[654],"CVE-2026-82901","2026-09-26T00:00:00Z","themefic","ultimate-addons-for-contact-form-7","NETSCAN-NUCLEI-CVE-CVE-2026-82901","Ultimate Addons for Contact Form 7 \u003C= 3.5.50 - Arbitrary File Upload"]