Posted by disclosure via Fulldisclosure on Aug 19

0day Rubbish Research Team is publicly disclosing a vulnerability in
VMS 6.48.809.

Type: Authenticated command injection to root RCE (CWE-78)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Impact: Authenticated attacker executes arbitrary commands as root via unsanitized command injection
Authentication: authenticated

Full technical analysis and a reproducible proof-of-concept:...

Posted by disclosure via Fulldisclosure on Aug 19

0day Rubbish Research Team is publicly disclosing a vulnerability in
ONE Reporter 13.1.

Type: Authenticated RCE / privilege escalation via CommandExecutor (CWE-78)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Impact: Low-privilege user executes arbitrary commands as local-admin service account
Authentication: authenticated

Full technical analysis and a reproducible proof-of-concept:...

Posted by disclosure via Fulldisclosure on Aug 19

0day Rubbish Research Team is publicly disclosing a vulnerability in
Gemini 7.3.0.

Type: Authenticated SQL injection to xp_cmdshell RCE (CWE-89)
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Impact: Authenticated user executes OS commands via stacked SQL and xp_cmdshell as sa/sysadmin
Authentication: authenticated

Full technical analysis and a reproducible proof-of-concept:...

Posted by disclosure via Fulldisclosure on Aug 19

0day Rubbish Research Team is publicly disclosing a vulnerability in
RoboTask 11.0.5.1229.

Type: Unauthenticated REST API remote task execution (CWE-306)
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: Unauthenticated attacker enumerates and triggers pre-existing tasks with Administrator privileges
Authentication: unauthenticated / pre-auth

Full technical analysis and a reproducible proof-of-concept:...

Posted by disclosure via Fulldisclosure on Aug 19

0day Rubbish Research Team is publicly disclosing a vulnerability in
ActiveFax Server 10.70.

Type: Unauthenticated LPD Ghostscript %pipe% SYSTEM RCE (CWE-78)
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Impact: Unauthenticated attacker executes arbitrary commands as SYSTEM via an LPD print job
Authentication: unauthenticated / pre-auth

Full technical analysis and a reproducible proof-of-concept:...

Posted by disclosure via Fulldisclosure on Aug 19

0day Rubbish Research Team is publicly disclosing a vulnerability in
Tornado 2.11.3.

Type: Unauthenticated arbitrary file write to root RCE (storeTo=file: to cron) (CWE-22)
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Impact: Unauthenticated attacker writes arbitrary files and achieves root command execution via cron
Authentication: unauthenticated / pre-auth

Full technical analysis and a reproducible proof-of-concept:...

Posted by disclosure via Fulldisclosure on Aug 19

0day Rubbish Research Team is publicly disclosing a vulnerability in
Datalore On-Premises 2026.2.3.

Type: Unauthenticated RCE via InteractiveReport access-mapping flaw (CWE-306)
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Impact: Anonymous attacker executes arbitrary code in the notebook agent container
Authentication: unauthenticated / pre-auth

Full technical analysis and a reproducible proof-of-concept:...

Posted by Apple Product Security via Fulldisclosure on Aug 19

APPLE-SA-08-18-2026-1 Safari 26.6.1

Safari 26.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/148286.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

WebKit
Available for: macOS Sonoma and macOS Sequoia
Impact: Processing maliciously crafted web content may lead to an
unexpected...

Posted by Nir Yehoshua on Aug 19

Hello Full Disclosure list,

Cipher Security Labs has published details for two vulnerabilities
affecting Cudy WR3000 hardware revision 2.0 running firmware before
version 2.5.24.

CVE-2026-71960 - Hard-coded JWT Secret Authentication Bypass
Severity: Critical, CVSS 9.3

The device firmware contains a hard-coded HMAC signing secret used by
the Mosquitto MQTT JWT authentication plugin. Because the secret can
be recovered from the firmware image,...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in XPressEntry 3.7.7454 (Telaeris Inc). The research
is published and a proof-of-concept is available.

Pre-authentication RCE (SQL injection) (CVSS 9.8, pre-authentication)

Telaeris XPressEntry 3.7.7454 runs its main HTTP API without authentication when RequireReaderCredentials is False,
which is the default. The SaveVerifyActivity handler concatenates the sNotes parameter into...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in Scrutinizer 19.7.0 (Plixer). The research is
published and a proof-of-concept is available.

Authenticated RCE (SQL injection) (CVSS 8.8, authenticated)

Plixer Scrutinizer 19.7.0 concatenates the HTTP orderBy parameter directly into a SQL ORDER BY clause with no escaping
in the adminEditLang handler. The default configuration includes the pg_cron extension and a PostgreSQL...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in Output Messenger Server 2.0.x (>= 2.0.63) (Srimax
Software (Output Technology)). The research is published and a proof-of-concept is available.

Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) (CVSS 9.8, pre-authentication)

Output Messenger Server 2.0.x accepts XMPP connections on TCP 14121 with no SASL and no credentials; every connection
is treated as...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in RapidDeploy 5.2.2 (MidVision). The research is
published and a proof-of-concept is available.

Pre-authentication RCE (arbitrary file write) (CVSS 9.8, pre-authentication)

MidVision RapidDeploy 5.2.2 ships a remote-agent template (midvision-remoting-server.xml) with host=0.0.0.0 and
auth.servers commented out, making the JBoss Remoting layer network-reachable with no...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in Lansweeper 12.2.1.0 (web reports 12.2.1.6)
(Lansweeper). The research is published and a proof-of-concept is available.

Authenticated RCE (second-order SQL injection) (CVSS 8.8, authenticated)

Lansweeper 12.2.1.0 contains a second-order SQL injection in the LicenseActions console. A SQL Server sub-server name
containing a single quote is stored and later concatenated...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI
Software). The research is published and a proof-of-concept is available.

Authenticated RCE (command injection) (CVSS 8.8, authenticated)

Kerio Connect 10.0.9 Patch 2 contains a command-injection vulnerability in the WebAdmin JSON-RPC method
Server.startEncryption. The password parameter is double-quoted and concatenated...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in PulseNET Enterprise 6.0.3 (build 6975) (GE
Vernova). The research is published and a proof-of-concept is available.

Pre-authentication RCE (default credentials + path traversal) (CVSS 9.8, pre-authentication)

GE Vernova PulseNET Enterprise 6.0.3 is the network-management software electric utilities use to monitor and manage
the industrial wireless networks connecting...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in Cinegy Cinegize 2026-02-05 installer (Cinegy
GmbH). The research is published and a proof-of-concept is available.

Pre-authentication RCE (BinaryFormatter deserialization) (CVSS 9.8, pre-authentication)

Cinegy Cinegize (2026-02-05 installer) registers a Windows service listening on TCP 51140 with a DotNetty pipeline that
deserializes .NET BinaryFormatter objects before the...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in Wyn Enterprise 9.1.00145.0 (Mescius (GrapeCity)).
The research is published and a proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

Wyn Enterprise 9.1.00145.0 exposes an unauthenticated root RCE chain of three vulnerabilities: JWT signature validation
is skipped (parse-only ReadToken) with a hardcoded integration client secret, producing an...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in ObjectDB 2.9.5 server mode (ObjectDB Software).
The research is published and a proof-of-concept is available.

Pre-authentication RCE (default credentials) (CVSS 9.8, pre-authentication)

ObjectDB 2.9.5 server mode (port 6136, proprietary binary protocol) has a critical remote code execution vulnerability:
JDOQL query filter evaluation allows arbitrary static-method...

Posted by disclosure via Fulldisclosure on Aug 17

0day Rubbish Research Team is publicly disclosing a vulnerability in nanoDLP stable build #10729 (Nano3Dtech). The
research is published and a proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

nanoDLP exposes an unauthenticated remote code execution vulnerability. The Guest (unauthenticated) endpoint POST
/formula evaluates user-supplied JavaScript in an embedded Otto JS sandbox, which exposes a live nanoDLP...