[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":58,"FormattedDate_PiEZQYtGbGm8twzEFcGQzp5YQYjVQkkZwVQf2fKukM":65,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":72,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":78,"$f17q7jdn7tll3p":85,"$f2r4b9phgo6bha":117,"finding-templates-{\"q\":\"\",\"page\":1}":119},[4,15,23,31,38],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":12,"variant":13,"campaign_id":14},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan","https:\u002F\u002Fpentest-tools.com\u002Fpricing",true,[11],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan","See pricing options","secondary","php2shell-rce",{"title":16,"slug":17,"text":18,"link":19,"external":20,"targets":21,"cta":19,"variant":13,"campaign_id":14},"PHP2Shell & Node2Shell detection - pricing page","php2shell-rce-pricing","PHP2Shell & Node2Shell detection live in every paid plan (unlimited rescans for patch validation)",null,false,[22],"\u002Fpricing",{"title":24,"slug":25,"text":26,"link":8,"external":9,"targets":27,"cta":12,"variant":13,"campaign_id":25},"Node2Shell detection - Vuln DB homepage, product, CVE page","node2shell","🚨 Detect Node2Shell \u002F HTTP2Shell with any paid plan. Get proof",[28,29,30],"\u002Fvulnerabilities-exploits","\u002Fproduct","\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",{"title":32,"slug":33,"text":34,"link":8,"external":9,"targets":35,"cta":37,"variant":13,"campaign_id":14},"PHP2Shell detection - NetScan on the NS page","php2shell-rce-netscan","🚨 Detect Node2Shell + PHP2Shell with NetScan (from $96\u002Fmo for 16 assets)",[36],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick NetScan",{"title":39,"slug":14,"text":40,"link":8,"external":9,"targets":41,"cta":12,"variant":13,"campaign_id":14},"PHP2Shell detection - top pages, pricing CTA","🚨 Detect Node2Shell + PHP2Shell with any paid plan. Get proof",[42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams",["Island",59],{"key":60,"params":61,"result":63},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":62},"{}",{"head":64},{},["Island",66],{"key":67,"params":68,"result":70},"FormattedDate_PiEZQYtGbGm8twzEFcGQzp5YQYjVQkkZwVQf2fKukM",{"props":69},"{\"date\":1793113307,\"format\":\"MMMM dd, yyyy\"}",{"head":71},{},["Island",73],{"key":74,"params":75,"result":76},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":62},{"head":77},{},["Island",79],{"key":80,"params":81,"result":83},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":82},"{\"text-color\":\"gray\"}",{"head":84},{},{"count":86,"next":87,"previous":19,"results":88},17566,"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?page=2&page_size=1",[89],{"id":90,"detectable_with":91,"vuln_details":98,"vuln_id":114,"name":115,"published":116,"updated":19},29928,{"tool":92,"engine":95},{"id":93,"name":94},1,"Network Scanner",{"id":96,"name":97},2,"Nuclei",{"id":90,"epss_score":99,"epss_percentile":100,"in_cisa_catalog":20,"codename":19,"public_description":101,"description":19,"severity":102,"risk_description":103,"public_recommendation":104,"recommendation":19,"references":105,"cvssv3":109,"cve":110,"date":112,"software_type":19,"vendor":113,"product":113,"ptt_exploit_capabilities":19,"category":19},0.0568,0.92962,"eXtplorer \u003C= 2.1.14 contains an authentication bypass in ext_find_user() (include\u002Fusers.php). When the `password` POST field is omitted entirely, the password is NULL and the function returns the matching user record without checking any password. With the default \"admin\" account, an unauthenticated attacker can log in as administrator.","critical","An unauthenticated attacker gains an administrator session in the file manager, giving full read\u002Fwrite access to the server filesystem and leading to remote code execution.","Upgrade to a patched eXtplorer release in which ext_find_user() requires a non-null password.",[106,107,108],"https:\u002F\u002Fwww.exploit-db.com\u002Fexploits\u002F51067","https:\u002F\u002Fgithub.com\u002Fsoerennb\u002Fextplorer\u002Fblob\u002Fv2.1.14\u002Finclude\u002Fusers.php","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2023-54335",9.8,[111],"CVE-2023-54335","2026-01-13T00:00:00Z","extplorer","NETSCAN-NUCLEI-CVE-CVE-2023-54335","eXtplorer \u003C= 2.1.14 - Authentication Bypass (CVE-2023-54335)","2026-10-29T00:00:00Z",{"count":118},210,{"count":86,"next":120,"previous":19,"results":121},"https:\u002F\u002Fvulndb.pentest-tools.com\u002Fapi\u002Fvulns\u002F?limit=25&page=2&search=",[122,145,169,177,200,221,244,257,272,295,318,343,365,387,409,432,455,477,499,520,540,559,579,602,617],{"id":123,"detectable_with":124,"vuln_details":127,"vuln_id":143,"name":144,"published":116,"updated":19},29926,{"tool":125,"engine":126},{"id":93,"name":94},{"id":96,"name":97},{"id":123,"codename":19,"description":19,"severity":102,"risk_description":128,"public_description":129,"public_recommendation":130,"recommendation":19,"references":131,"cvssv3":109,"epss_score":136,"epss_percentile":137,"cve":138,"in_cisa_catalog":20,"date":140,"software_type":19,"vendor":141,"product":142,"ptt_exploit_capabilities":19},"Unauthenticated attackers can inject PHP objects, potentially leading to remote code execution or full system compromise.","LearnPress WordPress plugin \u003C= 4.4.10 contains a PHP Object Injection caused by deserialization of untrusted 'checkout-email' parameter in checkout AJAX action, letting unauthenticated attackers inject PHP objects remotely.","Update to the latest version beyond 4.4.10.",[132,133,134,135],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve","https:\u002F\u002Fpatchstack.com\u002Fdatabase\u002Fwordpress\u002Fplugin\u002Flearnpress\u002Fvulnerability\u002Fwordpress-learnpress-wordpress-lms-plugin-for-create-and-sell-online-courses-plugin-4-4-10-unauthenticated-php-object-injection-vulnerability","https:\u002F\u002Fgithub.com\u002Fmurrez\u002FCVE-2026-104736","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-104736",0.00676,0.52105,[139],"CVE-2026-104736","2026-10-17T00:00:00Z","thimpress","learnpress","NETSCAN-NUCLEI-CVE-CVE-2026-104736","LearnPress \u003C= 4.4.9.1 - PHP Object Injection",{"id":146,"detectable_with":147,"vuln_details":150,"vuln_id":167,"name":168,"published":116,"updated":19},29927,{"tool":148,"engine":149},{"id":93,"name":94},{"id":96,"name":97},{"id":146,"codename":19,"description":19,"severity":151,"risk_description":152,"public_description":153,"public_recommendation":154,"recommendation":19,"references":155,"cvssv3":160,"epss_score":161,"epss_percentile":162,"cve":163,"in_cisa_catalog":20,"date":165,"software_type":19,"vendor":166,"product":166,"ptt_exploit_capabilities":19},"high","Unauthenticated attackers can reconstruct user password salts and hashes from LiveTableResults\nresponses, enabling offline credential cracking.","XWiki Platform is a generic wiki platform. The patch for GHSA-5cf8-vrr8-8hjm \u002F CVE-2023-26476 was insufficient. Starting with version 6.2.1 and prior to 16.10.17, 17.4.9, 17.10.13, and 18.0.0RC1, slightly modified LiveTableResults parameters (for example password_class) still allow an unauthenticated attacker to discover password hashes one bit at a time. With about 768 requests, the full password salt and hash of a user can be retrieved. The check for password and email properties does not consider the class passed via the _class parameters.","Upgrade XWiki to 16.10.17, 17.4.9, 17.10.13, 18.0.0RC1, or later. As a workaround, apply the patch manually to the wiki page XWiki.LiveTableResultsMacros.",[156,157,158,159],"https:\u002F\u002Fgithub.com\u002Fxwiki\u002Fxwiki-platform\u002Fsecurity\u002Fadvisories\u002FGHSA-rh28-mqj4-8x59","https:\u002F\u002Fjira.xwiki.org\u002Fbrowse\u002FXWIKI-23875","https:\u002F\u002Fgithub.com\u002Fxwiki\u002Fxwiki-platform\u002Fcommit\u002Fc4442716b02ffcdaa9d5e703b1db6203e36456fa","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48048",7.5,0.00651,0.51076,[164],"CVE-2026-48048","2026-08-10T00:00:00Z","xwiki","NETSCAN-NUCLEI-CVE-CVE-2026-48048","XWiki Platform - Password Hash Disclosure",{"id":90,"detectable_with":170,"vuln_details":173,"vuln_id":114,"name":176,"published":116,"updated":19},{"tool":171,"engine":172},{"id":93,"name":94},{"id":96,"name":97},{"id":90,"codename":19,"description":19,"severity":102,"risk_description":103,"public_description":101,"public_recommendation":104,"recommendation":19,"references":174,"cvssv3":109,"epss_score":99,"epss_percentile":100,"cve":175,"in_cisa_catalog":20,"date":112,"software_type":19,"vendor":113,"product":113,"ptt_exploit_capabilities":19},[106,107,108],[111],"eXtplorer \u003C= 2.1.14 - Authentication Bypass",{"id":178,"detectable_with":179,"vuln_details":182,"vuln_id":198,"name":199,"published":116,"updated":19},29929,{"tool":180,"engine":181},{"id":93,"name":94},{"id":96,"name":97},{"id":178,"codename":19,"description":19,"severity":102,"risk_description":183,"public_description":184,"public_recommendation":185,"recommendation":19,"references":186,"cvssv3":109,"epss_score":191,"epss_percentile":192,"cve":193,"in_cisa_catalog":20,"date":195,"software_type":19,"vendor":196,"product":197,"ptt_exploit_capabilities":19},"Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.","FUXA \u003C= 1.1.12 contains a SQL injection caused by unsanitized input in \u002Fapi\u002Fsignin, letting attackers execute arbitrary SQL commands, exploit requires sending crafted input to the endpoint.","Update to the latest version of FUXA to fix the vulnerability.",[187,188,189,190],"https:\u002F\u002Fgithub.com\u002FMateusTesser\u002FCVE-2023-31719","https:\u002F\u002Fgithub.com\u002Ffrangoteam\u002FFUXA\u002Fblob\u002Fv1.1.12\u002Fserver\u002Fruntime\u002Fusers\u002Fusrstorage.js","https:\u002F\u002Fgithub.com\u002Ffrangoteam\u002FFUXA\u002Fblob\u002Fv1.1.12\u002Fserver\u002Fapi\u002Fauth\u002Findex.js","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2023-31719",0.26032,0.97978,[194],"CVE-2023-31719","2023-09-22T00:00:00Z","frangoteam","fuxa","NETSCAN-NUCLEI-CVE-CVE-2023-31719","FUXA \u003C= 1.1.12 - Unauthenticated SQL Injection",{"id":201,"detectable_with":202,"vuln_details":205,"vuln_id":219,"name":220,"published":116,"updated":19},29932,{"tool":203,"engine":204},{"id":93,"name":94},{"id":96,"name":97},{"id":201,"codename":19,"description":19,"severity":151,"risk_description":206,"public_description":207,"public_recommendation":208,"recommendation":19,"references":209,"cvssv3":213,"epss_score":214,"epss_percentile":215,"cve":216,"in_cisa_catalog":20,"date":218,"software_type":19,"vendor":166,"product":166,"ptt_exploit_capabilities":19},"The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.","XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the \u002Fskin\u002F action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF\u002Fxwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.","Upgrade XWiki to later than 17.10.5 and 18.2.0.",[210,211,212],"https:\u002F\u002Fgithub.com\u002Fxwiki\u002Fxwiki-platform\u002Fsecurity\u002Fadvisories\u002FGHSA-qj4x-9g63-25g6","https:\u002F\u002Fjira.xwiki.org\u002Fbrowse\u002FXWIKI-24075","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34151",8.2,0.01062,0.6448,[217],"CVE-2026-34151","2026-09-14T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-34151","XWiki Platform - Path Traversal",{"id":222,"detectable_with":223,"vuln_details":226,"vuln_id":242,"name":243,"published":116,"updated":19},29931,{"tool":224,"engine":225},{"id":93,"name":94},{"id":96,"name":97},{"id":222,"codename":19,"description":19,"severity":151,"risk_description":227,"public_description":228,"public_recommendation":229,"recommendation":19,"references":230,"cvssv3":234,"epss_score":235,"epss_percentile":236,"cve":237,"in_cisa_catalog":20,"date":239,"software_type":19,"vendor":240,"product":241,"ptt_exploit_capabilities":19},"An unauthenticated attacker can coerce the GeoNetwork server into sending HTTP requests to internal hosts, enabling internal service interaction, cloud metadata access, and reconnaissance of the internal network from an anonymous position.","GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery (SSRF) in the SLD tool. The POST \u002Fsrv\u002Fapi\u002Ftools\u002Fogc\u002Fsld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any validation, allowing an anonymous attacker to make the server issue arbitrary outbound HTTP requests to internal services and read XML responses back.","Upgrade GeoNetwork to version 4.2.17, 4.4.12, or later.",[231,232,233],"https:\u002F\u002Fgithub.com\u002Fgeonetwork\u002Fcore-geonetwork\u002Fsecurity\u002Fadvisories\u002FGHSA-5hx7-j24v-rffj","https:\u002F\u002Fgithub.com\u002Fgeonetwork\u002Fcore-geonetwork\u002Fpull\u002F9343","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55864",8.6,0.00587,0.47922,[238],"CVE-2026-55864","2026-09-15T00:00:00Z","geonetwork","core-geonetwork","NETSCAN-NUCLEI-CVE-CVE-2026-55864","GeoNetwork - Server-Side Request Forgery (SSRF)",{"id":245,"detectable_with":246,"vuln_details":249,"vuln_id":255,"name":256,"published":116,"updated":19},29933,{"tool":247,"engine":248},{"id":93,"name":94},{"id":96,"name":97},{"id":245,"codename":19,"description":19,"severity":151,"risk_description":250,"public_description":251,"public_recommendation":252,"recommendation":19,"references":253,"cvssv3":19,"epss_score":19,"epss_percentile":19,"cve":19,"in_cisa_catalog":20,"date":19,"software_type":19,"vendor":19,"product":19,"ptt_exploit_capabilities":19},"The risk exists that a remote attacker might leverage the misconfigurations in order to compromise the target.","A Damn Vulnerable Web Application (DVWA) setup page is exposed. An unauthenticated attacker can use the setup page to reset the database, which restores the default credentials (admin:password), and the page discloses database configuration details.","We recommend you to analyze if this resource should be available or not.",[254],"https:\u002F\u002Fgithub.com\u002Fdigininja\u002FDVWA","NETSCAN-NUCLEI-MISCONFIGURATION-DVWA-SETUP","DVWA Exposed Setup Page",{"id":258,"detectable_with":259,"vuln_details":262,"vuln_id":270,"name":271,"published":116,"updated":19},29924,{"tool":260,"engine":261},{"id":93,"name":94},{"id":96,"name":97},{"id":258,"codename":19,"description":19,"severity":263,"risk_description":264,"public_description":265,"public_recommendation":266,"recommendation":19,"references":267,"cvssv3":19,"epss_score":19,"epss_percentile":19,"cve":19,"in_cisa_catalog":20,"date":19,"software_type":19,"vendor":269,"product":269,"ptt_exploit_capabilities":19},"medium","The risk exists that an attacker can use the vulnerability identified to perform further attacks on the server.","Diafan CMS 6.0 contains a reflected cross-site scripting vulnerability in the shop search functionality. The \"a\" parameter is not properly sanitized before being reflected in the response, allowing attackers to inject and execute arbitrary JavaScript in the context of a victim's browser.","Apply context-aware HTML output encoding to the \"a\" search parameter and validate user input before reflecting it into responses.",[268],"https:\u002F\u002Fgithub.com\u002Fdiafan\u002Fdiafan","diafan","NETSCAN-NUCLEI-VULNERABILITIES-DIAFAN-CMS-XSS","Diafan CMS 6.0 - Cross-Site Scripting",{"id":273,"detectable_with":274,"vuln_details":277,"vuln_id":293,"name":294,"published":116,"updated":19},29930,{"tool":275,"engine":276},{"id":93,"name":94},{"id":96,"name":97},{"id":273,"codename":19,"description":19,"severity":102,"risk_description":278,"public_description":279,"public_recommendation":280,"recommendation":19,"references":281,"cvssv3":109,"epss_score":287,"epss_percentile":288,"cve":289,"in_cisa_catalog":9,"date":291,"software_type":19,"vendor":292,"product":292,"ptt_exploit_capabilities":19},"The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network.","Zammad 6.3.0 to 6.5.4 contains a session hijack vulnerability caused by improper session management, letting remote attackers execute code as the zammad user, exploit requires vulnerable version and session hijack.","Update to a version later than 6.5.4 or 7.1.3 where the vulnerability is not exploitable.",[282,283,284,285,286],"https:\u002F\u002Fzammad.com\u002Fen\u002Fadvisories\u002Fcve-2026-102489-cve-2026-102490","https:\u002F\u002Fcsirt.divd.nl\u002FCVE-2026-102489","https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fdisclosures\u002Fcve-2026-102489-zammad-session-leak-rce\u002F","https:\u002F\u002Fgithub.com\u002Fhorizon3ai\u002FCVE-2026-102489","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102489",0.01955,0.80193,[290],"CVE-2026-102489","2026-09-30T00:00:00Z","zammad","NETSCAN-NUCLEI-CVE-CVE-2026-102489","Zammad 6.3.0-6.5.4 - Session Hijacking & Remote Code Execution",{"id":296,"detectable_with":297,"vuln_details":300,"vuln_id":316,"name":317,"published":116,"updated":19},29925,{"tool":298,"engine":299},{"id":93,"name":94},{"id":96,"name":97},{"id":296,"codename":19,"description":19,"severity":263,"risk_description":301,"public_description":302,"public_recommendation":303,"recommendation":19,"references":304,"cvssv3":308,"epss_score":309,"epss_percentile":310,"cve":311,"in_cisa_catalog":20,"date":313,"software_type":19,"vendor":314,"product":315,"ptt_exploit_capabilities":19},"Administrators can execute arbitrary SQL commands, potentially leading to data disclosure or modification.","The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.","Update to version 2.0.15 or later.",[305,306,307],"https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002F7b39bae3-41a2-4862-b7c3-1a386273d600\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-14554","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fcheck-email\u002F",6.5,0.00402,0.34319,[312],"CVE-2026-14554","2026-07-31T00:00:00Z","checkemail","check-email","NETSCAN-NUCLEI-CVE-CVE-2026-14554","WordPress Check & Log Email \u003C 2.0.15 - SQL Injection",{"id":319,"detectable_with":320,"vuln_details":323,"vuln_id":340,"name":341,"published":342,"updated":19},29917,{"tool":321,"engine":322},{"id":93,"name":94},{"id":96,"name":97},{"id":319,"codename":19,"description":19,"severity":263,"risk_description":324,"public_description":325,"public_recommendation":326,"recommendation":19,"references":327,"cvssv3":308,"epss_score":333,"epss_percentile":334,"cve":335,"in_cisa_catalog":20,"date":337,"software_type":19,"vendor":338,"product":339,"ptt_exploit_capabilities":19},"An unauthenticated attacker can read sensitive server configuration, including monitoring webhook URLs and bot tokens, and overwrite configuration, enabling secret disclosure and tampering with proxy and menu settings.","Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint \u002Fapi\u002Fconfig without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat\u002FTelegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structure and docker host settings, and can overwrite configuration via the unauthenticated POST handler. The fix restricts anonymous callers to a public subset (theme, language, logo, proxyDomain).","Upgrade Docker-Proxy to a release after 5.1.9 that restricts anonymous \u002Fapi\u002Fconfig access to a public subset (theme, language, logo, proxyDomain).",[328,329,330,331,332],"https:\u002F\u002Fgithub.com\u002Fdqzboy\u002FDocker-Proxy\u002Fsecurity\u002Fadvisories\u002FGHSA-xxpq-v3jg-w39m","https:\u002F\u002Fgithub.com\u002Fdqzboy\u002FDocker-Proxy\u002Fcommit\u002Fa173befc5d163b1206b40298871153026fee9474","https:\u002F\u002Fgithub.com\u002Fdqzboy\u002FDocker-Proxy\u002Fissues\u002F109","https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fdocker-proxy-through-5.1.9-missing-authentication-via-hubcmdui-api-config","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116070",0.00259,0.17626,[336],"CVE-2026-116070","2026-10-25T00:00:00Z","dqzboy","docker-proxy","NETSCAN-NUCLEI-CVE-CVE-2026-116070","Docker-Proxy hubcmdui - Missing Authentication on \u002Fapi\u002Fconfig","2026-10-28T00:00:00Z",{"id":344,"detectable_with":345,"vuln_details":348,"vuln_id":363,"name":364,"published":342,"updated":19},29918,{"tool":346,"engine":347},{"id":93,"name":94},{"id":96,"name":97},{"id":344,"codename":19,"description":19,"severity":151,"risk_description":349,"public_description":350,"public_recommendation":351,"recommendation":19,"references":352,"cvssv3":356,"epss_score":357,"epss_percentile":358,"cve":359,"in_cisa_catalog":20,"date":337,"software_type":19,"vendor":361,"product":362,"ptt_exploit_capabilities":19},"Script executes in the authenticated kernel origin and can invoke same-origin kernel APIs to read or modify workspace content and settings with the victim's session.","SiYuan 2.9.0 through 3.8.6 serves the unauthenticated \u002Fcheck-auth authorization page (app\u002Fstage\u002Fauth.html) with a script that assigns the `to` query parameter to window.location.href without scheme validation. A crafted link whose `to` value is a javascript: URI executes script in the kernel origin once the victim completes authentication on that page.","Update to SiYuan 3.8.7 or later, which routes the `to` value through safeRedirectTarget and only allows same-origin destinations.",[353,354,355],"https:\u002F\u002Fgithub.com\u002Fsiyuan-note\u002Fsiyuan\u002Fsecurity\u002Fadvisories\u002FGHSA-fmj3-xc2f-6w4w","https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fsiyuan-2.9.0-before-3.8.7-xss-via-check-auth-to-parameter","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116167",7.6,0.0025,0.16371,[360],"CVE-2026-116167","siyuan-note","siyuan","NETSCAN-NUCLEI-CVE-CVE-2026-116167","SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth \"to\" Parameter",{"id":366,"detectable_with":367,"vuln_details":370,"vuln_id":385,"name":386,"published":342,"updated":19},29922,{"tool":368,"engine":369},{"id":93,"name":94},{"id":96,"name":97},{"id":366,"codename":19,"description":19,"severity":102,"risk_description":371,"public_description":372,"public_recommendation":373,"recommendation":19,"references":374,"cvssv3":109,"epss_score":379,"epss_percentile":380,"cve":381,"in_cisa_catalog":20,"date":383,"software_type":19,"vendor":384,"product":384,"ptt_exploit_capabilities":19},"Attackers can bypass authentication on protected routes, gaining unauthorized access to restricted resources.","Traefik \u003C 2.11.55 contains an authentication bypass caused by digestAuth middleware returning empty secret for unknown usernames, letting attackers bypass authentication on digestAuth-protected routes without valid credentials.","Update to version 2.11.55 or later.",[375,376,377,378],"https:\u002F\u002Fgithub.com\u002Ftraefik\u002Ftraefik\u002Fsecurity\u002Fadvisories\u002FGHSA-5w68-77r2-r64c","https:\u002F\u002Fgithub.com\u002Fcontainous\u002Fgo-http-auth\u002Fcommit\u002Fb975dcaa8c48","https:\u002F\u002Fgithub.com\u002Ftraefik\u002Ftraefik\u002Fcommit\u002F2116686308a2","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-85595",0.02451,0.8433,[382],"CVE-2026-85595","2026-09-04T00:00:00Z","traefik","NETSCAN-NUCLEI-CVE-CVE-2026-85595","Traefik \u003C 2.11.55 \u002F 3.0.0 - 3.7.10 - Digest Authentication Bypass",{"id":388,"detectable_with":389,"vuln_details":392,"vuln_id":407,"name":408,"published":342,"updated":19},29920,{"tool":390,"engine":391},{"id":93,"name":94},{"id":96,"name":97},{"id":388,"codename":19,"description":19,"severity":102,"risk_description":393,"public_description":394,"public_recommendation":395,"recommendation":19,"references":396,"cvssv3":399,"epss_score":400,"epss_percentile":401,"cve":402,"in_cisa_catalog":20,"date":404,"software_type":19,"vendor":405,"product":406,"ptt_exploit_capabilities":19},"Unauthenticated attackers can obtain API tokens, leading to third-party service compromise, PHI exfiltration, and HIPAA violations.","OpenEMR \u003C 8.0.0 contains an unauthenticated token disclosure caused by bypassing authentication in the MedEx callback endpoint, letting unauthenticated visitors obtain MedEx API tokens and perform unauthorized actions, exploit requires crafted POST request with callback_key.","Upgrade to version 8.0.0 or later.",[397,398],"https:\u002F\u002Fgithub.com\u002Fopenemr\u002Fopenemr\u002Fsecurity\u002Fadvisories\u002FGHSA-qwff-3mw7-7rc7","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24898",10,0.00577,0.47441,[403],"CVE-2026-24898","2026-03-03T00:00:00Z","open-emr","openemr","NETSCAN-NUCLEI-CVE-CVE-2026-24898","OpenEMR \u003C 8.0.0 - MedEx Callback Unauthenticated Token Disclosure",{"id":410,"detectable_with":411,"vuln_details":414,"vuln_id":430,"name":431,"published":342,"updated":19},29921,{"tool":412,"engine":413},{"id":93,"name":94},{"id":96,"name":97},{"id":410,"codename":19,"description":19,"severity":263,"risk_description":415,"public_description":416,"public_recommendation":417,"recommendation":19,"references":418,"cvssv3":308,"epss_score":424,"epss_percentile":425,"cve":426,"in_cisa_catalog":20,"date":428,"software_type":19,"vendor":429,"product":429,"ptt_exploit_capabilities":19},"An unauthenticated attacker can coerce the MLflow server into making outbound requests to arbitrary internal or external hosts with attacker-controlled headers, enabling access to internal services, cloud metadata endpoints, and other resources reachable from the server.","MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST \u002Fajax-api\u002F3.0\u002Fmlflow\u002Fscorer\u002Finvoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission.","Upgrade MLflow to 3.17.0 or later, which constrains third-party scorer classes and their constructor kwargs.",[419,420,421,422,423],"https:\u002F\u002Fgithub.com\u002Fmlflow\u002Fmlflow\u002Fsecurity\u002Fadvisories\u002FGHSA-2wqp-q3c6-ccj5","https:\u002F\u002Fgithub.com\u002Fmlflow\u002Fmlflow\u002Fcommit\u002Fbac30b4148c4f40045b4d4db07ae60ab3838803f","https:\u002F\u002Fgithub.com\u002Fmlflow\u002Fmlflow\u002Fpull\u002F25890","https:\u002F\u002Fgithub.com\u002Fmlflow\u002Fmlflow\u002Freleases\u002Ftag\u002Fv3.17.0","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-115886",0.00324,0.25325,[427],"CVE-2026-115886","2026-10-23T00:00:00Z","mlflow","NETSCAN-NUCLEI-CVE-CVE-2026-115886","MLflow \u003C3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorer",{"id":433,"detectable_with":434,"vuln_details":437,"vuln_id":453,"name":454,"published":342,"updated":19},29923,{"tool":435,"engine":436},{"id":93,"name":94},{"id":96,"name":97},{"id":433,"codename":19,"description":19,"severity":102,"risk_description":278,"public_description":438,"public_recommendation":439,"recommendation":19,"references":440,"cvssv3":445,"epss_score":446,"epss_percentile":447,"cve":448,"in_cisa_catalog":9,"date":450,"software_type":19,"vendor":451,"product":452,"ptt_exploit_capabilities":19},"Collabora Online Built-in CODE Server before 26.4.303 contains a command injection caused by improper handling in proxy.php when the CODE server is not running, letting remote attackers execute OS commands, exploit requires CODE server to be stopped.","Upgrade to version 26.4.303 or later.",[441,442,443,444],"https:\u002F\u002Fgithub.com\u002FCollaboraOnline\u002Frichdocumentscode\u002Fissues\u002F354","https:\u002F\u002Fgithub.com\u002FCollaboraOnline\u002Frichdocumentscode\u002Fcompare\u002F26.4.302...26.4.303","https:\u002F\u002Fgithub.com\u002FCVEProject\u002FcvelistV5\u002Fblob\u002Fmain\u002Fcves\u002F2026\u002F110xxx\u002FCVE-2026-110447.json","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-110447",9.2,0.11634,0.96034,[449],"CVE-2026-110447","2026-10-14T00:00:00Z","collabora","richdocumentscode","NETSCAN-NUCLEI-CVE-CVE-2026-110447","Collabora Built-in CODE Server \u003C 26.4.303 - OS Command Injection",{"id":456,"detectable_with":457,"vuln_details":460,"vuln_id":475,"name":476,"published":342,"updated":19},29919,{"tool":458,"engine":459},{"id":93,"name":94},{"id":96,"name":97},{"id":456,"codename":19,"description":19,"severity":151,"risk_description":461,"public_description":462,"public_recommendation":463,"recommendation":19,"references":464,"cvssv3":160,"epss_score":469,"epss_percentile":470,"cve":471,"in_cisa_catalog":20,"date":140,"software_type":19,"vendor":473,"product":474,"ptt_exploit_capabilities":19},"Attackers can access sensitive customer PII including names, emails, phone numbers, and booking details, compromising user privacy and data confidentiality.","WP Booking System – Booking Calendar plugin for WordPress \u003C= 2.1.0.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers read stored notification emails exposing customer PII, exploit requires authenticated Subscriber-level user.","Update to the latest version beyond 2.1.0.3.",[465,466,467,468],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fwordpress-plugins\u002Fwp-booking-system\u002Fwp-booking-system-2103-missing-authorization-to-unauthenticated-email-log-disclosure","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fchangeset\u002F3750085\u002Fwp-booking-system","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fwp-booking-system\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-108123",0.00318,0.24597,[472],"CVE-2026-108123","wpbookingsystem","wp-booking-system","NETSCAN-NUCLEI-CVE-CVE-2026-108123","WP Booking System \u003C= 2.1.0.3 - Unauthenticated Email Log Disclosure",{"id":478,"detectable_with":479,"vuln_details":482,"vuln_id":496,"name":497,"published":498,"updated":19},29916,{"tool":480,"engine":481},{"id":93,"name":94},{"id":96,"name":97},{"id":478,"codename":19,"description":19,"severity":263,"risk_description":483,"public_description":484,"public_recommendation":485,"recommendation":19,"references":486,"cvssv3":490,"epss_score":491,"epss_percentile":492,"cve":493,"in_cisa_catalog":20,"date":337,"software_type":19,"vendor":495,"product":495,"ptt_exploit_capabilities":19},"Remote attackers can fetch arbitrary URLs, potentially accessing internal hosts and sensitive data.","YesWiki \u003C 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of [[|URL]] wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication.","Update to version 4.7.0 or later.",[487,488,489],"https:\u002F\u002Fgithub.com\u002FYesWiki\u002Fyeswiki\u002Fsecurity\u002Fadvisories\u002FGHSA-x9j5-r988-9jcc","https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fyeswiki-before-4.7.0-unauthenticated-ssrf-via-url-raw-inclusion-syntax","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116205",5.3,0.0051,0.43365,[494],"CVE-2026-116205","yeswiki","NETSCAN-NUCLEI-CVE-CVE-2026-116205","YesWiki \u003C 4.7.0 - Unauthenticated Server-Side Request Forgery","2026-10-27T00:00:00Z",{"id":500,"detectable_with":501,"vuln_details":504,"vuln_id":518,"name":519,"published":498,"updated":19},29911,{"tool":502,"engine":503},{"id":93,"name":94},{"id":96,"name":97},{"id":500,"codename":19,"description":19,"severity":102,"risk_description":505,"public_description":506,"public_recommendation":507,"recommendation":19,"references":508,"cvssv3":399,"epss_score":511,"epss_percentile":512,"cve":513,"in_cisa_catalog":20,"date":515,"software_type":19,"vendor":516,"product":517,"ptt_exploit_capabilities":19},"Unauthenticated attackers can overwrite arbitrary files, including .htaccess, potentially breaking the site and disabling security measures.","W3 Total Cache WordPress plugin \u003C 2.10.5 contains an unrestricted file write vulnerability caused by improper validation of request paths used for cache file names, letting unauthenticated attackers overwrite files including .htaccess, exploit requires no authentication.","Upgrade to version 2.10.5 or later.",[509,510],"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-18051","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Fdc56cdd2-419b-4a64-9d2a-29dc7e79cb6d\u002F",0.02007,0.8076,[514],"CVE-2026-18051","2026-08-19T00:00:00Z","boldgrid","w3-total-cache","NETSCAN-NUCLEI-CVE-CVE-2026-18051","W3 Total Cache \u003C 2.10.5 - Unauthenticated Arbitrary Directory File Write",{"id":521,"detectable_with":522,"vuln_details":525,"vuln_id":538,"name":539,"published":498,"updated":19},29913,{"tool":523,"engine":524},{"id":93,"name":94},{"id":96,"name":97},{"id":521,"codename":19,"description":19,"severity":102,"risk_description":278,"public_description":526,"public_recommendation":527,"recommendation":19,"references":528,"cvssv3":399,"epss_score":531,"epss_percentile":532,"cve":533,"in_cisa_catalog":20,"date":535,"software_type":19,"vendor":536,"product":537,"ptt_exploit_capabilities":19},"Huang Yaoshi Pharmaceutical Management Software up to 16.0 contains an unrestricted file upload caused by accepting .asp filenames in the UploadFile element of a SOAP request to \u002FXSDService.asmx, letting attackers upload arbitrary files, exploit requires sending a crafted SOAP request.","Update to the latest version or apply security patches that restrict file types and validate file uploads.",[529,530],"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-66fj-74pq-7rwx","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56829",0.02059,0.81244,[534],"CVE-2024-56829","2025-01-02T00:00:00Z","huangyaoshi","huang_yaoshi","NETSCAN-NUCLEI-CVE-CVE-2024-56829","Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload",{"id":541,"detectable_with":542,"vuln_details":545,"vuln_id":557,"name":558,"published":498,"updated":19},29915,{"tool":543,"engine":544},{"id":93,"name":94},{"id":96,"name":97},{"id":541,"codename":19,"description":19,"severity":102,"risk_description":546,"public_description":547,"public_recommendation":548,"recommendation":19,"references":549,"cvssv3":445,"epss_score":553,"epss_percentile":554,"cve":555,"in_cisa_catalog":20,"date":337,"software_type":19,"vendor":19,"product":19,"ptt_exploit_capabilities":19},"Remote attackers can bypass authentication, potentially gaining unauthorized access to the system.","ruoyi-vue-pro (Yudao) ships base configuration yudao.sms-code.begin-code=end-code=9999, so every generated SMS verification code is the constant \"9999\" in all profiles. The anonymous SMS-login flow therefore grants an access token to any account whose mobile number is known: send-sms-code followed by sms-login with code 9999 issues a full token, including for the seeded super administrator account (mobile 18818260272 in the shipped SQL). No CAPTCHA hook exists for scene=21 in any profile.","Update to the latest version.",[550,551,552],"https:\u002F\u002Fgist.github.com\u002FFulucky0-yuri\u002F1ad8a1f166af7cb85c498473753a8636","https:\u002F\u002Fgithub.com\u002FYunaiV\u002Fruoyi-vue-pro","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116006",0.00834,0.57528,[556],"CVE-2026-116006","NETSCAN-NUCLEI-CVE-CVE-2026-116006","Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code",{"id":560,"detectable_with":561,"vuln_details":564,"vuln_id":577,"name":578,"published":498,"updated":19},29914,{"tool":562,"engine":563},{"id":93,"name":94},{"id":96,"name":97},{"id":560,"codename":19,"description":19,"severity":102,"risk_description":565,"public_description":566,"public_recommendation":567,"recommendation":19,"references":568,"cvssv3":109,"epss_score":572,"epss_percentile":573,"cve":574,"in_cisa_catalog":20,"date":576,"software_type":19,"vendor":19,"product":19,"ptt_exploit_capabilities":19},"Unauthenticated attackers can modify server environment, lock out operators, cause SSRF, and trigger redeployment, severely impacting server integrity and availability.","danmu_api before 1.21.7 contains an authentication bypass caused by default TOKEN usage and unset ADMIN_TOKEN, letting unauthenticated attackers modify server environment configuration via specific API endpoints, exploit requires default token configuration.","Update to version 1.21.7 or later.",[569,570,571],"https:\u002F\u002Fgithub.com\u002Fhuangxd-\u002Fdanmu_api\u002Fcommit\u002F6e93478064a0ce4e7ed3bc2eae88adaad1b7ab02","https:\u002F\u002Fgithub.com\u002Fhuangxd-\u002Fdanmu_api","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116485",0.02349,0.83626,[575],"CVE-2026-116485","2026-10-26T00:00:00Z","NETSCAN-NUCLEI-CVE-CVE-2026-116485","danmu_api - Unauthenticated Access to Admin API via Default Token",{"id":580,"detectable_with":581,"vuln_details":584,"vuln_id":600,"name":601,"published":498,"updated":19},29909,{"tool":582,"engine":583},{"id":93,"name":94},{"id":96,"name":97},{"id":580,"codename":19,"description":19,"severity":151,"risk_description":585,"public_description":586,"public_recommendation":587,"recommendation":19,"references":588,"cvssv3":592,"epss_score":593,"epss_percentile":594,"cve":595,"in_cisa_catalog":20,"date":597,"software_type":19,"vendor":598,"product":599,"ptt_exploit_capabilities":19},"An unauthenticated attacker can inject persistent JavaScript that executes in an administrator's browser session when they view form entries, leading to admin session hijacking, rogue account creation, and full site takeover.","NEX-Forms Express WP Form Builder plugin for WordPress before 9.2.3 is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin registers a wp_ajax_nopriv_submit_nex_form handler for form submissions. Array-type field values are processed through rest_sanitize_array(), which only reindexes the array and performs no HTML sanitization, so markup is stored verbatim. When an administrator views the submitted entries, the stored payload renders without esc_html() escaping and executes arbitrary JavaScript in the admin's browser. Scalar fields are not affected (they are passed through strip_tags()).","Update NEX-Forms Express WP Form Builder to 9.2.3 or later, which recursively sanitizes array field inputs (nf_recursive_sanitize).",[589,590,591],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-10525","https:\u002F\u002Fwpscan.com\u002Fvulnerability\u002Fd1e191e6-ff5b-4cb8-9b12-8ae73cf0d2f0\u002F","https:\u002F\u002Fwordpress.org\u002Fplugins\u002Fnex-forms-express-wp-form-builder\u002F",8.8,0.00512,0.4354,[596],"CVE-2026-10525","2026-07-17T00:00:00Z","basix","nex-forms-express-wp-form-builder","NETSCAN-NUCLEI-CVE-CVE-2026-10525","NEX-Forms Express WP Form Builder \u003C 9.2.3 - Unauthenticated Stored XSS",{"id":603,"detectable_with":604,"vuln_details":607,"vuln_id":615,"name":616,"published":498,"updated":19},29910,{"tool":605,"engine":606},{"id":93,"name":94},{"id":96,"name":97},{"id":603,"codename":19,"description":19,"severity":263,"risk_description":608,"public_description":609,"public_recommendation":610,"recommendation":19,"references":611,"cvssv3":19,"epss_score":19,"epss_percentile":19,"cve":19,"in_cisa_catalog":20,"date":19,"software_type":19,"vendor":613,"product":614,"ptt_exploit_capabilities":19},"The risk exists that the data is unknowingly exposed to the internet, making it accessible to remote threat actors that can leverage it to attack the target, or the entire company, depending on the sensitivity of the data.","Detects if the config page of the Lighter server is exposed, it is an opensource REST application for interacting with Apache Spark on Kubernetes or Apache Hadoop YARN.","We suggest restricting access to the exposed resource.",[612],"https:\u002F\u002Fgithub.com\u002Fexacaster\u002Flighter","exacaster","lighter","NETSCAN-NUCLEI-EXPOSURES-LIGHTER-CONFIG","Lighter - Config Exposed",{"id":618,"detectable_with":619,"vuln_details":622,"vuln_id":635,"name":636,"published":498,"updated":19},29912,{"tool":620,"engine":621},{"id":93,"name":94},{"id":96,"name":97},{"id":618,"codename":19,"description":19,"severity":102,"risk_description":278,"public_description":623,"public_recommendation":624,"recommendation":19,"references":625,"cvssv3":399,"epss_score":628,"epss_percentile":629,"cve":630,"in_cisa_catalog":9,"date":632,"software_type":19,"vendor":633,"product":634,"ptt_exploit_capabilities":19},"Ahsay AhsayCBS \u003C= 10.3.2 contains a command injection caused by manipulation of the \\\"random\\\" argument in \u002Frps\u002Fapi\u002Fjson\u002FUpdateReceivers.do of Replication Receiver, letting remote attackers execute OS commands, exploit requires crafted request","Upgrade to version 10.3.4.",[626,627],"https:\u002F\u002Fhorizon3.ai\u002Fattack-research\u002Fattack-blogs\u002Fahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis\u002F","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-105134",0.81763,0.99644,[631],"CVE-2026-105134","2026-10-04T00:00:00Z","ahsay","ahsaycbs","NETSCAN-NUCLEI-CVE-CVE-2026-105134","AhsayCBS \u003C= 10.3.4 - Unauthenticated RCE"]