Bulletins d'actualité

Classification

TLP:WHITEC0

Exploits Web

[remote] Teltonika_RutOS 00.07.06.21 - command injection Teltonika_RutOS 00.07.06.21 - command injection

[webapps] TigerGraph_Community_Edition 4.2.4 - arbitrary file write TigerGraph_Community_Edition 4.2.4 - arbitrary file write

[webapps] WordPress 7.0.2 - Path Travesal WordPress 7.0.2 - Path Travesal

[webapps] Food-Ordering 1.0 - LFI Food-Ordering 1.0 - LFI

[remote] Ecava_ntegraXor IGX_16.0.701.10 - RCE Ecava_ntegraXor IGX_16.0.701.10 - RCE

[webapps] Krayin CRM 2.2.4 - IDOR Krayin CRM 2.2.4 - IDOR

[webapps] SuiteCRM 8.10.1 - Authenticated SSRF SuiteCRM 8.10.1 - Authenticated SSRF

[webapps] InvoicePlane 1.7.1 - RCE InvoicePlane 1.7.1 - RCE

[webapps] POMS oretnom23v1.0 - SQLi vulnerabilities POMS oretnom23v1.0 - SQLi vulnerabilities

[remote] MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 - RCE MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 - RCE

[remote] CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE

[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE) FreePBX 17.0.2 - Remote Code Execution (RCE)

[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution Metabase 0.61.0 - Authenticated Remote Code Execution

[dos] EVerest 2025.9.0 - DoS EVerest 2025.9.0 - DoS

[webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting Bludit CMS 3.20.0 - Reflected Cross-Site Scripting