Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits.
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.
This vulnerability was…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The…
Opis źródłowy NVD · ENCVSS 9,4 · EPSS 0,38 % · rekomendacja wg zapisanej polityki
phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,41 % · rekomendacja wg zapisanej polityki
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object.
This vulnerability was…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might be called under normal API requests. Due to…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,39 % · rekomendacja wg zapisanej polityki
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,4 · EPSS 0,38 % · rekomendacja wg zapisanej polityki