[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":44,"FormattedDate_nAg3h2XsX6RqFnk1SOU1oGWRxFImjqdBQB8ia3aVnk":51,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":58,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":64,"$f17q7jdn7tll3p":71,"$f2r4b9phgo6bha":104,"finding-templates-{\"q\":\"\",\"page\":1}":106},[4,15,21,27,33,39],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Network Scanner","compliance-pages-launch-network-scanner","Scheduled scans are the spine of every compliance framework. Are you audit-ready?","https:\u002F\u002Fpentest-tools.com\u002Fusage\u002Fcompliance",false,[11],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Get compliance evidence","secondary","compliance-pages-launch",{"title":16,"slug":17,"text":18,"link":8,"external":9,"targets":19,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Website Scanner","compliance-pages-launch-website-scanner","Authenticated web-app scans show up in SOC 2, NIS2, and CRA Annex I. See why this is crucial for the business.",[20],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner",{"title":22,"slug":23,"text":24,"link":8,"external":9,"targets":25,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Advanced Pentest Reporting","compliance-pages-launch-reporting","Editable DOCX. Immutable PDF. JSON for the GRC tool. See why these formats are on every auditor's checklist.",[26],"\u002Ffeatures\u002Fpentest-reporting",{"title":28,"slug":29,"text":30,"link":8,"external":9,"targets":31,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Integrations","compliance-pages-launch-integrations","Vanta, Jira, webhooks - they all route back to DORA, NIS2, SOC 2, ISO 27001, CRA. See why this is crucial for the business.",[32],"\u002Ffeatures\u002Fintegrations",{"title":34,"slug":35,"text":36,"link":8,"external":9,"targets":37,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Sniper","compliance-pages-launch-sniper","Five compliance framework pages now reference Sniper as the source of validated exploitability evidence. See them all.",[38],"\u002Fexploit-helpers\u002Fsniper",{"title":40,"slug":14,"text":41,"link":8,"external":9,"targets":42,"cta":12,"variant":13,"campaign_id":14},"Compliance - Page Launch - Homepage","Turn confirmed vulnerabilities into evidence your auditor accepts. Testing requirements for DORA, NIS2, SOC 2, ISO 27001, and CRA.",[43],"\u002F",["Island",45],{"key":46,"params":47,"result":49},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":48},"{}",{"head":50},{},["Island",52],{"key":53,"params":54,"result":56},"FormattedDate_nAg3h2XsX6RqFnk1SOU1oGWRxFImjqdBQB8ia3aVnk",{"props":55},"{\"date\":1791358396,\"format\":\"MMMM dd, yyyy\"}",{"head":57},{},["Island",59],{"key":60,"params":61,"result":62},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":48},{"head":63},{},["Island",65],{"key":66,"params":67,"result":69},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":68},"{\"text-color\":\"gray\"}",{"head":70},{},{"count":72,"next":73,"previous":74,"results":75},17500,"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?page=2&page_size=1",null,[76],{"id":77,"detectable_with":78,"vuln_details":85,"vuln_id":101,"name":102,"published":103,"updated":74},29825,{"tool":79,"engine":82},{"id":80,"name":81},1,"Network Scanner",{"id":83,"name":84},2,"Nuclei",{"id":77,"epss_score":86,"epss_percentile":87,"in_cisa_catalog":9,"codename":74,"public_description":88,"description":74,"severity":89,"risk_description":90,"public_recommendation":91,"recommendation":74,"references":92,"cvssv3":95,"cve":96,"date":98,"software_type":74,"vendor":99,"product":100,"ptt_exploit_capabilities":74,"category":74},0.01589,0.75205,"Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 expose the Patroni REST API (PostgreSQL sidecar) on SHC members without authentication. An unauthenticated attacker can PATCH \u002Fconfig to set a malicious archive_command and POST \u002Frestart to trigger it, achieving remote code execution with the privileges of the PostgreSQL process via the classic Patroni RCE chain.","critical","The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","Upgrade Splunk Enterprise to version 10.2.7 or 10.4.3 or later.",[93,94],"https:\u002F\u002Fadvisory.splunk.com\u002Fadvisories\u002FSVD-2026-1001","https:\u002F\u002Fpocbit.org\u002Fpocs\u002Fcve-2026-76268",9.8,[97],"CVE-2026-76268","2026-10-07T00:00:00Z","splunk","splunk_enterprise","NETSCAN-NUCLEI-CVE-CVE-2026-76268","Splunk Enterprise Patroni REST API - Missing Authentication RCE (CVE-2026-76268)","2026-10-16T00:00:00Z",{"count":105},210,{"count":72,"next":107,"previous":74,"results":108},"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?limit=25&page=2&search=",[109,117,141,163,179,193,216,241,263,286,309,331,352,373,394,412,431,450,465,486,507,528,549,570,591],{"id":77,"detectable_with":110,"vuln_details":113,"vuln_id":101,"name":116,"published":103,"updated":74},{"tool":111,"engine":112},{"id":80,"name":81},{"id":83,"name":84},{"id":77,"codename":74,"description":74,"severity":89,"risk_description":90,"public_description":88,"public_recommendation":91,"recommendation":74,"references":114,"cvssv3":95,"epss_score":86,"epss_percentile":87,"cve":115,"in_cisa_catalog":9,"date":98,"software_type":74,"vendor":99,"product":100,"ptt_exploit_capabilities":74},[93,94],[97],"Splunk Enterprise Patroni REST API - Missing Authentication RCE",{"id":118,"detectable_with":119,"vuln_details":122,"vuln_id":138,"name":139,"published":140,"updated":74},29823,{"tool":120,"engine":121},{"id":80,"name":81},{"id":83,"name":84},{"id":118,"codename":74,"description":74,"severity":89,"risk_description":123,"public_description":124,"public_recommendation":125,"recommendation":74,"references":126,"cvssv3":95,"epss_score":130,"epss_percentile":131,"cve":132,"in_cisa_catalog":134,"date":135,"software_type":74,"vendor":136,"product":137,"ptt_exploit_capabilities":74},"Attackers can send requests to the JMX-Console GET handler using other HTTP methods, potentially leading to unauthorized access or control.","JBoss EAP 4.2 (before 4.2.0.CP09) and 4.3 (before 4.3.0.CP08) only enforce authentication for GET\u002FPOST on the JMX and Web consoles because the web.xml security-constraint enumerates only those verbs in \u003Chttp-method>. Non-standard verbs such as HEAD skip the constraint, granting unauthenticated access to MBean operations (which can lead to remote code execution).","Update to version 4.2.0.CP09 or later for 4.2, and 4.3.0.CP08 or later for 4.3, or apply security patches provided by Red Hat.",[127,128,129],"https:\u002F\u002Faccess.redhat.com\u002Fsolutions\u002F30744","https:\u002F\u002Fgithub.com\u002Fjoaomatosf\u002Fjexboss","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2010-0738",0.74722,0.995,[133],"CVE-2010-0738",true,"2010-04-28T00:00:00Z","redhat","jboss_enterprise_application_platform","NETSCAN-NUCLEI-CVE-CVE-2010-0738","JBoss JMX\u002FWeb Console - Authentication Bypass via HTTP Verb Tampering","2026-10-15T00:00:00Z",{"id":142,"detectable_with":143,"vuln_details":146,"vuln_id":161,"name":162,"published":140,"updated":74},29820,{"tool":144,"engine":145},{"id":80,"name":81},{"id":83,"name":84},{"id":142,"codename":74,"description":74,"severity":89,"risk_description":90,"public_description":147,"public_recommendation":148,"recommendation":74,"references":149,"cvssv3":95,"epss_score":154,"epss_percentile":155,"cve":156,"in_cisa_catalog":9,"date":158,"software_type":74,"vendor":159,"product":160,"ptt_exploit_capabilities":74},"Request a Quote for WooCommerce plugin for WordPress \u003C= 2.9.2 contains an unrestricted file upload vulnerability caused by missing file extension and MIME type validation in afrfq_submit_quote_via_popup(), letting unauthenticated attackers upload executable files, exploit requires enabled public quote rule with multi-page popup flow.","Update to the latest version of Request a Quote for WooCommerce plugin.",[150,151,152,153],"https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Fwoocommerce-request-a-quote\u002Fvulnerability\u002Fwordpress-request-a-quote-for-woocommerce-plugin-2-9-2-unauthenticated-arbitrary-file-upload-vulnerability","https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F3417ec27-6abf-45c7-945f-6ef456ba1187?source=cve","https:\u002F\u002Fgithub.com\u002Fmurrez\u002FCVE-2026-18143","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-18143",0.01709,0.76929,[157],"CVE-2026-18143","2026-09-26T00:00:00Z","addify","woocommerce-request-a-quote","NETSCAN-NUCLEI-CVE-CVE-2026-18143","Request Quote for WooCommerce \u003C= 2.9.2 - Unauthenticated Arbitrary File Upload",{"id":164,"detectable_with":165,"vuln_details":168,"vuln_id":177,"name":178,"published":140,"updated":74},29821,{"tool":166,"engine":167},{"id":80,"name":81},{"id":83,"name":84},{"id":164,"codename":74,"description":74,"severity":169,"risk_description":170,"public_description":171,"public_recommendation":172,"recommendation":74,"references":173,"cvssv3":74,"epss_score":74,"epss_percentile":74,"cve":74,"in_cisa_catalog":9,"date":74,"software_type":74,"vendor":175,"product":176,"ptt_exploit_capabilities":74},"high","The risk exist that a remote attacker could take advantage of the default credentials for taking over the default account. If an authenticated vulnerability is present on the machine, it could also be leveraged to exploit the target, compromising the underlying system.","Apache SkyWalking next-generation UI (Horizon). An attacker can execute unauthorized operations.","Change the default login credentials. Use a strong password, at least 10 characters long, preferably randomly generated. Unless the login panel is intended to be exposed to the internet, we strongly recommend placing it behind a firewall.",[174],"https:\u002F\u002Fgithub.com\u002Fapache\u002Fskywalking-horizon-ui","apache","skywalking","NETSCAN-NUCLEI-DEFAULT-LOGINS-APACHE-SKYWALKING-DEFAULT-LOGIN","Apache SkyWalking Horizon UI - Default Login",{"id":180,"detectable_with":181,"vuln_details":184,"vuln_id":191,"name":192,"published":140,"updated":74},29822,{"tool":182,"engine":183},{"id":80,"name":81},{"id":83,"name":84},{"id":180,"codename":74,"description":74,"severity":185,"risk_description":186,"public_description":187,"public_recommendation":188,"recommendation":74,"references":189,"cvssv3":74,"epss_score":74,"epss_percentile":74,"cve":74,"in_cisa_catalog":9,"date":74,"software_type":74,"vendor":175,"product":190,"ptt_exploit_capabilities":74},"low","The risk exists that the data is unknowingly exposed to the internet, making it accessible to remote threat actors that can leverage it to attack the target, or the entire company, depending on the sensitivity of the data.","Detects if path \u002Fapi\u002Fauth\u002Foidc\u002Fproviders and \u002Fapi\u002Fauth\u002Fhealth of SkyWalking Horizon UI server is exposed, getting authentication information.","We suggest restricting access to the exposed resource.",[174],"skywalking-horizon-ui","NETSCAN-NUCLEI-EXPOSURES-APACHE-SKYWALKING-HORIZON-UI-CONFIG","Apache SkyWalking Horizon UI - Config Exposure",{"id":194,"detectable_with":195,"vuln_details":198,"vuln_id":214,"name":215,"published":140,"updated":74},29824,{"tool":196,"engine":197},{"id":80,"name":81},{"id":83,"name":84},{"id":194,"codename":74,"description":74,"severity":169,"risk_description":199,"public_description":200,"public_recommendation":201,"recommendation":74,"references":202,"cvssv3":206,"epss_score":207,"epss_percentile":208,"cve":209,"in_cisa_catalog":9,"date":211,"software_type":74,"vendor":212,"product":213,"ptt_exploit_capabilities":74},"An unauthenticated attacker can execute arbitrary SQL against the WordPress database, enabling extraction of user accounts, password hashes and other sensitive data.","WP Fast Total Search (fulltext-search) versions up to and including 1.80.280 contain an unauthenticated time-based blind SQL injection. The wp_ajax_nopriv_wpfts_autocomplete handler reads the form_data[s] parameter and feeds it into a WP_Query. The plugin's index_sql_where() builds its cluster query with double-quoted string literals using esc_like() which only escapes LIKE wildcards and not quotes, allowing a double quote to break out of the literal. When form_data[sentence] is set, the search term is used verbatim, giving a clean injection point.","Update WP Fast Total Search to version 1.81.282 or later.",[203,204,205],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-12741","https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe9b6fe22-330a-4c24-9fdf-16f35516fb2a?source=cve","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Ffulltext-search\u002Ftags\u002F1.80.280\u002Fincludes\u002Fwpfts_search.php#L825",7.5,0.01588,0.75199,[210],"CVE-2026-12741","2026-07-28T00:00:00Z","wp-fast-total-search","wp_fast_total_search","NETSCAN-NUCLEI-CVE-CVE-2026-12741","WP Fast Total Search \u003C= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection",{"id":217,"detectable_with":218,"vuln_details":221,"vuln_id":238,"name":239,"published":240,"updated":74},29813,{"tool":219,"engine":220},{"id":80,"name":81},{"id":83,"name":84},{"id":217,"codename":74,"description":74,"severity":89,"risk_description":222,"public_description":223,"public_recommendation":224,"recommendation":74,"references":225,"cvssv3":95,"epss_score":231,"epss_percentile":232,"cve":233,"in_cisa_catalog":9,"date":235,"software_type":74,"vendor":236,"product":237,"ptt_exploit_capabilities":74},"Successful exploitation allows unauthenticated attackers to execute arbitrary SQL queries against the PostGIS database, potentially leading to full database exfiltration, data manipulation, or remote code execution on the database server via COPY TO PROGRAM.","GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Patches are available in GeoTools 33.6 and 34.5. No known workaround is available, so the scope can only be limited by restricting which CQL functions are exposed.","Upgrade GeoTools to version 33.6 or 34.5, or a GeoServer release that bundles one of them.",[226,227,228,229,230],"https:\u002F\u002Fgist.github.com\u002Fportbuster1337\u002F70d75ec246b85e3199037ce212ff1a06","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76904","https:\u002F\u002Fgithub.com\u002Fgeotools\u002Fgeotools\u002Fcommit\u002Fd821c4d321dd91c22e31fcd5b1ce676645da5176","https:\u002F\u002Fgithub.com\u002Fgeotools\u002Fgeotools\u002Fpull\u002F5829","https:\u002F\u002Fgithub.com\u002Fgeotools\u002Fgeotools\u002Freleases\u002Ftag\u002F33.6",0.03976,0.90349,[234],"CVE-2026-76904","2026-08-21T00:00:00Z","osgeo","geoserver","NETSCAN-NUCLEI-CVE-CVE-2026-76904","GeoServer jsonArrayContains CQL Filter - SQL Injection","2026-10-14T00:00:00Z",{"id":242,"detectable_with":243,"vuln_details":246,"vuln_id":261,"name":262,"published":240,"updated":74},29814,{"tool":244,"engine":245},{"id":80,"name":81},{"id":83,"name":84},{"id":242,"codename":74,"description":74,"severity":169,"risk_description":247,"public_description":248,"public_recommendation":249,"recommendation":74,"references":250,"cvssv3":253,"epss_score":254,"epss_percentile":255,"cve":256,"in_cisa_catalog":9,"date":258,"software_type":74,"vendor":259,"product":260,"ptt_exploit_capabilities":74},"Successful exploitation requires logged-in users to click a malicious link, but allows unauthenticated attackers to execute arbitrary scripts or change web page contents on authenticated user sessions.","The weMail plugin for WordPress \u003C 2.1.3 is vulnerable to reflected cross-site scripting. The plugin does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response.","Upgrade to weMail version 2.1.3 or later.",[251,252],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Ff00c1853-a4b2-4e91-99b3-fed8acbe6da7\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwemail\u002F",7.1,0.00524,0.43182,[257],"CVE-2026-8089","2026-06-17T00:00:00Z","weDevs","weMail","NETSCAN-NUCLEI-CVE-CVE-2026-8089","WordPress weMail \u003C 2.1.3 - Cross-Site Scripting",{"id":264,"detectable_with":265,"vuln_details":268,"vuln_id":284,"name":285,"published":240,"updated":74},29811,{"tool":266,"engine":267},{"id":80,"name":81},{"id":83,"name":84},{"id":264,"codename":74,"description":74,"severity":169,"risk_description":269,"public_description":270,"public_recommendation":271,"recommendation":74,"references":272,"cvssv3":276,"epss_score":277,"epss_percentile":278,"cve":279,"in_cisa_catalog":9,"date":281,"software_type":74,"vendor":282,"product":283,"ptt_exploit_capabilities":74},"Unauthenticated attackers can read arbitrary files from the server, including application configuration and secrets, which can lead to further compromise.","Next4Biz CSM exposes the DownloadFileHandler.ashx endpoint, whose file parameter is passed to a path helper that never confirms the resolved path stays inside the upload directory before the file is streamed back. Because Path.Combine returns an absolute second argument verbatim, an unauthenticated attacker can supply an absolute Windows path and read any file the IIS application pool identity can open.","Update to the vendor-provided fixed release.",[273,274,275],"https:\u002F\u002F1dayexploit.com\u002Fblog\u002Fcve-2026-6377-next4biz-csm-path-traversal\u002F","https:\u002F\u002Fgithub.com\u002F1dayexploit\u002Fadvisories\u002Ftree\u002Fmain\u002Fadvisories\u002Fcve-2026-6377-next4biz-csm-path-traversal","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-6377",8.6,0.01761,0.77614,[280],"CVE-2026-6377","2026-09-07T00:00:00Z","next4biz","csm","NETSCAN-NUCLEI-CVE-CVE-2026-6377","Next4Biz CSM - Arbitrary File Read via DownloadFileHandler",{"id":287,"detectable_with":288,"vuln_details":291,"vuln_id":307,"name":308,"published":240,"updated":74},29816,{"tool":289,"engine":290},{"id":80,"name":81},{"id":83,"name":84},{"id":287,"codename":74,"description":74,"severity":89,"risk_description":90,"public_description":292,"public_recommendation":293,"recommendation":74,"references":294,"cvssv3":95,"epss_score":300,"epss_percentile":301,"cve":302,"in_cisa_catalog":134,"date":304,"software_type":74,"vendor":305,"product":306,"ptt_exploit_capabilities":74},"Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.","Update to the latest version of Check Point Management Server.",[295,296,297,298,299],"https:\u002F\u002Fsupport.checkpoint.com\u002Fresults\u002Fsk\u002Fsk1000171","https:\u002F\u002Fblog.checkpoint.com\u002Fsecurity\u002Fsecurity-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616\u002F","https:\u002F\u002Fgithub.com\u002FBishopFox\u002FCVE-2026-93616-check","https:\u002F\u002Fgithub.com\u002FWadesWeaponShed\u002FCVE-2026-93616_Checks","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-93616",0.75872,0.99524,[303],"CVE-2026-93616","2026-09-22T00:00:00Z","checkpoint","quantum_security_management","NETSCAN-NUCLEI-CVE-CVE-2026-93616","Check Point Security Management - Unauthenticated Directory Traversal to RCE",{"id":310,"detectable_with":311,"vuln_details":314,"vuln_id":329,"name":330,"published":240,"updated":74},29819,{"tool":312,"engine":313},{"id":80,"name":81},{"id":83,"name":84},{"id":310,"codename":74,"description":74,"severity":89,"risk_description":315,"public_description":316,"public_recommendation":317,"recommendation":74,"references":318,"cvssv3":321,"epss_score":322,"epss_percentile":323,"cve":324,"in_cisa_catalog":134,"date":326,"software_type":74,"vendor":327,"product":328,"ptt_exploit_capabilities":74},"An unauthenticated attacker can bypass authentication and access protected CGI endpoints on the Ivanti Connect Secure appliance, leading to remote code execution with root privileges when chained with additional vulnerabilities.","Ivanti Connect Secure VPN appliances contain an authentication bypass vulnerability in how the appliance routes requests from front- and back-end processes to CGI script handlers. The URL path is used to determine whether a request is allowed (welcome.cgi is public), while the X-DSCGI-PATH header determines the actual destination of the request. An attacker can send a request to the unauthenticated welcome.cgi endpoint with an X-DSCGI-PATH header pointing to an authenticated CGI script such as wu.cgi, bypassing authentication entirely. This vulnerability is chained with a file write race condition in wu.cgi and a privilege escalation via dsinvoked DSCache trust to achieve unauthenticated root-level remote code execution.","Upgrade Ivanti Connect Secure to the patched version released on October 13, 2026. Affected versions include 25.1.1 and prior, 25.1.2, and 22.8R2.4.",[319,320],"https:\u002F\u002Fwww.volexity.com\u002Fblog\u002F2026\u002F10\u002F13\u002Fa-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days\u002F","https:\u002F\u002Fforums.ivanti.com",10,0.25982,0.97965,[325],"CVE-2026-104935","2026-10-13T00:00:00Z","ivanti","connect_secure","NETSCAN-NUCLEI-CVE-CVE-2026-104935","Ivanti Connect Secure \u003C= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header",{"id":332,"detectable_with":333,"vuln_details":336,"vuln_id":350,"name":351,"published":240,"updated":74},29817,{"tool":334,"engine":335},{"id":80,"name":81},{"id":83,"name":84},{"id":332,"codename":74,"description":74,"severity":89,"risk_description":337,"public_description":338,"public_recommendation":339,"recommendation":74,"references":340,"cvssv3":321,"epss_score":343,"epss_percentile":344,"cve":345,"in_cisa_catalog":9,"date":347,"software_type":74,"vendor":348,"product":349,"ptt_exploit_capabilities":74},"Unauthenticated callers obtain an internal service identity on the API gateway, reaching privileged IAM, secrets, node inventory and ingest operations with no credential. On a confirmed deployment the forged identity was authorized on 136 API paths, including POST to \u002Fapis\u002Fiam\u002Fv2\u002Fpolicies, \u002Fapis\u002Fiam\u002Fv2\u002Ftokens and \u002Fapis\u002Fiam\u002Fv2\u002Fusers, so it converts directly into persistent administrative access.","Chef Automate derives an internal service identity from an X.509 certificate supplied in a request header without verifying its issuer. The load balancer blanks X-Client-Cert but does not strip the Grpc-Metadata- prefixed variants, which grpc-gateway rewrites into the metadata key the gateway's auth middleware reads. A remote unauthenticated attacker can present a self-signed certificate naming an internal service such as deployment-service and be authenticated as that service.","Upgrade to Chef Automate 4.13.520 or later, which adds x509 chain verification to the header certificate path and strips the Grpc-Metadata prefixed headers at the load balancer. As an independent mitigation, blank Grpc-Metadata-Grpcgateway-X-Client-Cert, Grpc-Metadata-X-Client-Cert and X-Client-Cert at any proxy in front of Automate, repeating the directives in every location block that proxies to the gateway.",[341,342],"https:\u002F\u002Fcommunity.progress.com\u002Fs\u002Farticle\u002FCritical-Security-Bulletin---August-2026---Chef-Automate-Security-Vulnerability","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80462",0.02006,0.80476,[346],"CVE-2026-80462","2026-09-11T00:00:00Z","progress","chef_automate","NETSCAN-NUCLEI-CVE-CVE-2026-80462","Chef Automate API Gateway - Authentication Bypass",{"id":353,"detectable_with":354,"vuln_details":357,"vuln_id":371,"name":372,"published":240,"updated":74},29812,{"tool":355,"engine":356},{"id":80,"name":81},{"id":83,"name":84},{"id":353,"codename":74,"description":74,"severity":169,"risk_description":358,"public_description":359,"public_recommendation":360,"recommendation":74,"references":361,"cvssv3":364,"epss_score":365,"epss_percentile":366,"cve":367,"in_cisa_catalog":9,"date":369,"software_type":74,"vendor":370,"product":370,"ptt_exploit_capabilities":74},"Unauthorized users can access post titles and excerpts, leading to information disclosure.","Discourse \u003C 2026.1.2\u002F2026.2.1\u002F2026.3.0-latest.1 contains an information disclosure vulnerability caused by lack of visibility checks in a user action API endpoint, letting unauthorized users access post titles and excerpts, exploit requires no special privileges.","Upgrade Discourse to 2026.1.2, 2026.2.1, 2026.3.0-latest.1, or later.",[362,363],"https:\u002F\u002Fgithub.com\u002Fdiscourse\u002Fdiscourse\u002Fsecurity\u002Fadvisories\u002FGHSA-824f-66wh-xx3g","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-27934",8.7,0.01434,0.7263,[368],"CVE-2026-27934","2026-03-19T00:00:00Z","discourse","NETSCAN-NUCLEI-CVE-CVE-2026-27934","Discourse \u003C 2026.1.2\u002F2026.2.1\u002F2026.3.0-latest.1 - Unauthenticated Private User Action Disclosure",{"id":374,"detectable_with":375,"vuln_details":378,"vuln_id":392,"name":393,"published":240,"updated":74},29818,{"tool":376,"engine":377},{"id":80,"name":81},{"id":83,"name":84},{"id":374,"codename":74,"description":74,"severity":379,"risk_description":380,"public_description":381,"public_recommendation":382,"recommendation":74,"references":383,"cvssv3":386,"epss_score":387,"epss_percentile":388,"cve":389,"in_cisa_catalog":9,"date":391,"software_type":74,"vendor":370,"product":370,"ptt_exploit_capabilities":74},"medium","Unauthenticated attackers can determine private group membership, potentially exposing sensitive user information.","Discourse \u003C 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contains an information disclosure caused by unauthenticated users observing directory results changes with the exclude_groups parameter, letting attackers determine private group membership, exploit requires public access to user directory.","Update to versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later; alternatively, disable public access to user directory.",[384,385],"https:\u002F\u002Fgithub.com\u002Fdiscourse\u002Fdiscourse\u002Fsecurity\u002Fadvisories\u002FGHSA-r6rh-xvf5-r5f2","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33425",5.3,0.00765,0.54551,[390],"CVE-2026-33425","2026-03-21T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-33425","Discourse - Private Group Membership Inference via exclude_groups",{"id":395,"detectable_with":396,"vuln_details":399,"vuln_id":410,"name":411,"published":240,"updated":74},29815,{"tool":397,"engine":398},{"id":80,"name":81},{"id":83,"name":84},{"id":395,"codename":74,"description":74,"severity":169,"risk_description":400,"public_description":401,"public_recommendation":402,"recommendation":74,"references":403,"cvssv3":406,"epss_score":74,"epss_percentile":74,"cve":407,"in_cisa_catalog":9,"date":74,"software_type":74,"vendor":409,"product":409,"ptt_exploit_capabilities":74},"An authenticated attacker can access internal HTTP services from the SuiteCRM server's network context and may obtain response data through error messages.","SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services.","Upgrade to SuiteCRM 7.15.2, 8.10.2, or a later release.",[404,405],"https:\u002F\u002Fgithub.com\u002FSuiteCRM\u002FSuiteCRM\u002Fsecurity\u002Fadvisories\u002FGHSA-72r3-24x4-j46c","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-69137",7.7,[408],"CVE-2026-69137","suitecrm","NETSCAN-NUCLEI-CVE-CVE-2026-69137","SuiteCRM \u003C= 7.15.1, \u003C= 8.10.1 - Authenticated SSRF",{"id":413,"detectable_with":414,"vuln_details":417,"vuln_id":429,"name":430,"published":326,"updated":74},29806,{"tool":415,"engine":416},{"id":80,"name":81},{"id":83,"name":84},{"id":413,"codename":74,"description":74,"severity":89,"risk_description":90,"public_description":418,"public_recommendation":419,"recommendation":74,"references":420,"cvssv3":95,"epss_score":422,"epss_percentile":423,"cve":424,"in_cisa_catalog":9,"date":426,"software_type":74,"vendor":427,"product":428,"ptt_exploit_capabilities":74},"When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm command execution.","Upgrade Bifrost to transports v2.1.0 or later and enable dashboard authentication.",[421],"https:\u002F\u002Fgithub.com\u002Fmaximhq\u002Fbifrost\u002Fpull\u002F6757",0.02311,0.83091,[425],"CVE-2026-90898","2026-09-14T00:00:00Z","maximhq","bifrost","NETSCAN-NUCLEI-CVE-CVE-2026-90898","Bifrost \u003C 2.1.0 - Unauthenticated MCP Stdio Command Execution",{"id":432,"detectable_with":433,"vuln_details":436,"vuln_id":448,"name":449,"published":326,"updated":74},29808,{"tool":434,"engine":435},{"id":80,"name":81},{"id":83,"name":84},{"id":432,"codename":74,"description":74,"severity":379,"risk_description":437,"public_description":438,"public_recommendation":439,"recommendation":74,"references":440,"cvssv3":386,"epss_score":443,"epss_percentile":444,"cve":445,"in_cisa_catalog":9,"date":447,"software_type":74,"vendor":74,"product":74,"ptt_exploit_capabilities":74},"Attackers can enumerate valid user accounts, potentially aiding targeted attacks or privilege escalation.","MikroTik RouterOS v6.43.13 through v6.49.13 and v6.43 through v7.17.2 contain an account enumeration issue caused by response size discrepancy in Winbox service, letting attackers identify valid usernames, exploit requires network access to Winbox service.","Update to stable release v6.49.18 or later.",[441,442],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-54772","https:\u002F\u002Fgithub.com\u002Fdeauther890\u002FCVE-2024-54772",0.01288,0.69711,[446],"CVE-2024-54772","2025-02-11T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2024-54772","MikroTik WinBox \u003C= 6.49.17 - Username Enumeration",{"id":451,"detectable_with":452,"vuln_details":455,"vuln_id":463,"name":464,"published":326,"updated":74},29804,{"tool":453,"engine":454},{"id":80,"name":81},{"id":83,"name":84},{"id":451,"codename":74,"description":74,"severity":169,"risk_description":170,"public_description":456,"public_recommendation":457,"recommendation":74,"references":458,"cvssv3":74,"epss_score":74,"epss_percentile":74,"cve":74,"in_cisa_catalog":9,"date":74,"software_type":74,"vendor":461,"product":462,"ptt_exploit_capabilities":74},"MITRE Caldera was found using default credentials. When started with the insecure default configuration, both the v4 (classic) and v5 (Magma) consoles ship static operator accounts (red, blue and admin) that all authenticate with the password \"admin\". An attacker who logs in gains full control of the adversary-emulation server and can run operations that execute commands on every connected agent.","Change all default credentials immediately and configure unique, strong passwords for each operator account.",[459,460],"https:\u002F\u002Fgithub.com\u002Fmitre\u002Fcaldera","https:\u002F\u002Fcaldera.readthedocs.io\u002Fen\u002Flatest\u002FServer-Configuration.html","mitre","caldera","NETSCAN-NUCLEI-DEFAULT-LOGINS-CALDERA-DEFAULT-LOGIN","MITRE Caldera - Default Login",{"id":466,"detectable_with":467,"vuln_details":470,"vuln_id":484,"name":485,"published":326,"updated":74},29805,{"tool":468,"engine":469},{"id":80,"name":81},{"id":83,"name":84},{"id":466,"codename":74,"description":74,"severity":169,"risk_description":471,"public_description":472,"public_recommendation":473,"recommendation":74,"references":474,"cvssv3":253,"epss_score":254,"epss_percentile":478,"cve":479,"in_cisa_catalog":9,"date":481,"software_type":74,"vendor":482,"product":483,"ptt_exploit_capabilities":74},"Attackers can execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, potentially leading to session hijacking or privilege escalation.","The Tag Groups WordPress plugin \u003C 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, exploit requires victim interaction.","Update the Tag Groups plugin to version 2.2.0 or later.",[475,476,477],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9833","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F75792c33-2d9d-46db-a98c-00ec40951099\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Ftag-groups\u002F",0.43181,[480],"CVE-2026-9833","2026-07-20T00:00:00Z","publishpress","tag-groups","NETSCAN-NUCLEI-CVE-CVE-2026-9833","WordPress Tag Groups \u003C 2.2.0 - Reflected Cross-Site Scripting",{"id":487,"detectable_with":488,"vuln_details":491,"vuln_id":505,"name":506,"published":326,"updated":74},29809,{"tool":489,"engine":490},{"id":80,"name":81},{"id":83,"name":84},{"id":487,"codename":74,"description":74,"severity":89,"risk_description":492,"public_description":493,"public_recommendation":494,"recommendation":74,"references":495,"cvssv3":95,"epss_score":498,"epss_percentile":499,"cve":500,"in_cisa_catalog":9,"date":502,"software_type":74,"vendor":503,"product":504,"ptt_exploit_capabilities":74},"An unauthenticated attacker can read arbitrary files including the ECDSA signing key, enabling them to forge access JWTs and bypass authentication for any account.","LaunchServer's Netty FileServerHandler computes the served path by stripping one leading character on the assumption that every request-target begins with '\u002F'. Netty's HttpServerCodec accepts a request-target without a leading slash verbatim, so a request without a leading slash bypasses path normalization and escapes the updatesDir. The file server is enabled by default (netty.fileServerEnabled=true) on 0.0.0.0:9274 with no authentication, allowing an unauthenticated remote GET to read any file readable by the LaunchServer process including its own ECDSA signing key (.keys\u002Fecdsa_id), which signs access JWTs and enables full authentication bypass for any account.","Upgrade GravitLauncher LaunchServer to a version newer than 5.7.11.",[496,497],"https:\u002F\u002Fgithub.com\u002FGravitLauncher\u002FLauncher\u002Fsecurity\u002Fadvisories\u002FGHSA-5g75-477j-2c2f","https:\u002F\u002Fgithub.com\u002FGravitLauncher\u002FLauncher\u002Fcommit\u002F1e0b3a3",0.02883,0.86634,[501],"CVE-2026-54617","2026-09-17T00:00:00Z","gravitlauncher","launchserver","NETSCAN-NUCLEI-CVE-CVE-2026-54617","GravitLauncher LaunchServer \u003C=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read",{"id":508,"detectable_with":509,"vuln_details":512,"vuln_id":526,"name":527,"published":326,"updated":74},29810,{"tool":510,"engine":511},{"id":80,"name":81},{"id":83,"name":84},{"id":508,"codename":74,"description":74,"severity":169,"risk_description":513,"public_description":514,"public_recommendation":515,"recommendation":74,"references":516,"cvssv3":206,"epss_score":519,"epss_percentile":520,"cve":521,"in_cisa_catalog":9,"date":523,"software_type":74,"vendor":524,"product":525,"ptt_exploit_capabilities":74},"The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.","The Divi Plus WordPress plugin through 2.4.0 exposes the \u002Fwp-json\u002Felicus\u002Fv1\u002Fdipl-modules\u002Fsvg-animator REST route with a permission callback that returns true unconditionally, and passes the svg_image parameter to file_get_contents() without any path restriction, so an unauthenticated attacker can read any file readable by the web server user.","Update Divi Plus to version 2.4.1 or later.",[517,518],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-91136","https:\u002F\u002Fgithub.com\u002Ffl0ydsec\u002FCVE-2026-91136",0.01782,0.77897,[522],"CVE-2026-91136","2026-10-10T00:00:00Z","elicus","divi_plus","NETSCAN-NUCLEI-CVE-CVE-2026-91136","Divi Plus \u003C= 2.4.0 - Unauthenticated Arbitrary File Read",{"id":529,"detectable_with":530,"vuln_details":533,"vuln_id":547,"name":548,"published":326,"updated":74},29807,{"tool":531,"engine":532},{"id":80,"name":81},{"id":83,"name":84},{"id":529,"codename":74,"description":74,"severity":89,"risk_description":90,"public_description":534,"public_recommendation":535,"recommendation":74,"references":536,"cvssv3":95,"epss_score":540,"epss_percentile":541,"cve":542,"in_cisa_catalog":9,"date":544,"software_type":74,"vendor":545,"product":546,"ptt_exploit_capabilities":74},"Selenium Server (Grid) before 4.0.0-alpha-7 permits unauthenticated session creation and unsafe capability injection via \u002Fwd\u002Fhub\u002Fsession due to missing Origin validation and weak content-type enforcement.","Upgrade to Selenium Server 4.0.0-alpha-7 or later and restrict network exposure.",[537,538,539],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2022-28108","https:\u002F\u002Fwww.gabriel.urdhr.fr\u002F2022\u002F02\u002F07\u002Fselenium-standalone-server-csrf-dns-rebinding-rce\u002F","https:\u002F\u002Fgithub.com\u002FSeleniumHQ\u002Fselenium\u002Fblob\u002Ftrunk\u002Fjava\u002FCHANGELOG",0.22193,0.97651,[543],"CVE-2022-28108","2022-04-19T00:00:00Z","selenium","selenium_grid","NETSCAN-NUCLEI-CVE-CVE-2022-28108","Selenium Grid \u003C 4.0.0-alpha-7 - Remote Code Execution",{"id":550,"detectable_with":551,"vuln_details":554,"vuln_id":567,"name":568,"published":569,"updated":74},29803,{"tool":552,"engine":553},{"id":80,"name":81},{"id":83,"name":84},{"id":550,"codename":74,"description":74,"severity":169,"risk_description":513,"public_description":555,"public_recommendation":556,"recommendation":74,"references":557,"cvssv3":206,"epss_score":560,"epss_percentile":561,"cve":562,"in_cisa_catalog":9,"date":564,"software_type":74,"vendor":565,"product":566,"ptt_exploit_capabilities":74},"Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.","Upgrade Eclipse Theia to the patched version.",[558,559],"https:\u002F\u002Fgithub.com\u002Feclipse-theia\u002Ftheia\u002Fsecurity\u002Fadvisories\u002FGHSA-qmm6-p8q4-2g48","https:\u002F\u002Fgitlab.eclipse.org\u002Fsecurity\u002Fcve-assignment\u002F-\u002Fwork_items\u002F133",0.01644,0.76022,[563],"CVE-2026-12609","2026-08-05T00:00:00Z","eclipse","theia","NETSCAN-NUCLEI-CVE-CVE-2026-12609","Eclipse Theia - Unauthenticated Path Traversal","2026-10-12T00:00:00Z",{"id":571,"detectable_with":572,"vuln_details":575,"vuln_id":589,"name":590,"published":569,"updated":74},29801,{"tool":573,"engine":574},{"id":80,"name":81},{"id":83,"name":84},{"id":571,"codename":74,"description":74,"severity":89,"risk_description":576,"public_description":577,"public_recommendation":578,"recommendation":74,"references":579,"cvssv3":74,"epss_score":583,"epss_percentile":584,"cve":585,"in_cisa_catalog":9,"date":587,"software_type":74,"vendor":588,"product":588,"ptt_exploit_capabilities":74},"An unauthenticated remote attacker can invoke privileged FOSSBilling system API methods and may access or modify administrator-managed data.","FOSSBilling versions 0.5.4 through 0.7.x contain an authorization bypass in API role handling. The internal system role is accepted from the URL, resolves to the cron-admin identity, and reaches privileged system API methods without authentication, a session, or a CSRF token. Version 0.8.0 rejects the system route role.","Upgrade FOSSBilling to 0.8.0 or later, or block external access to \u002Fapi\u002Fsystem\u002F*.",[580,581,582],"https:\u002F\u002Fgithub.com\u002FFOSSBilling\u002FFOSSBilling\u002Fsecurity\u002Fadvisories\u002FGHSA-78x5-c8gw-8279","https:\u002F\u002Fgithub.com\u002FFOSSBilling\u002FFOSSBilling\u002Freleases\u002Ftag\u002F0.8.0","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-27604",0.01264,0.69213,[586],"CVE-2026-27604","2026-06-23T00:00:00Z","fossbilling","NETSCAN-NUCLEI-CVE-CVE-2026-27604","FOSSBilling 0.5.4-0.7.x - Unauthenticated System API Role Authorization Bypass",{"id":592,"detectable_with":593,"vuln_details":596,"vuln_id":608,"name":609,"published":569,"updated":74},29802,{"tool":594,"engine":595},{"id":80,"name":81},{"id":83,"name":84},{"id":592,"codename":74,"description":74,"severity":379,"risk_description":597,"public_description":598,"public_recommendation":599,"recommendation":74,"references":600,"cvssv3":602,"epss_score":603,"epss_percentile":604,"cve":605,"in_cisa_catalog":9,"date":607,"software_type":74,"vendor":370,"product":370,"ptt_exploit_capabilities":74},"An unauthenticated attacker can forge bounce-status webhook events to artificially inflate a user's bounce score, causing that user's legitimate emails to be disabled.","Discourse's WebhooksController contains a missing-authentication flaw caused by accepting requests to provider webhook endpoints (including \u002Fwebhooks\u002Fmailpace, SendGrid, Mailjet, Mandrill, Postmark, and SparkPost) without validating a token when none is configured, which is the default state, letting an unauthenticated attacker forge webhook payloads.","Upgrade Discourse to the patched version, which rejects any provider webhook request with HTTP 406 when no authentication token is configured for that provider.",[601],"https:\u002F\u002Fgithub.com\u002Fdiscourse\u002Fdiscourse\u002Fsecurity\u002Fadvisories\u002FGHSA-j67c-53j2-4hfw",6.5,0.01136,0.6595,[606],"CVE-2026-26077","2026-02-26T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-26077","Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery"]