Egidio Romano

**Name of the Vulnerable Software and Affected Versions** Telenia Software TVox versions prior to 26.5.4 Telenia Software TVox versions prior to 24.9.22 **Description** An insecure sudoers configuration in `/etc/sudoers.d/telenia` allows attackers with access to the apache account to escalate privileges. The configuration grants the apache user the ability to execute `/bin/nice` with the `NOPASSWD` option, which can be leveraged to invoke arbitrary commands as root without providing a password. **Recommendations** Update Telenia Software TVox to a version later than 26.5.3. Update Telenia Software TVox to a version later than 24.9.21.

**Name of the Vulnerable Software and Affected Versions** Telenia Software TVox versions prior to 26.5.3 Telenia Software TVox versions prior to 24.9.21 **Description** An authentication bypass exists in the `set env.php` file. The `redirectToLoginAdminIRequestHaveAccessToken()` function determines the current page name using the `PHP SELF` variable and fails to require authentication if the value matches 'login admin.php'. An attacker can bypass security checks and gain unauthorized access to all PHP scripts within the manager HTML directory by appending '/login admin.php' to the path of any target PHP script. **Recommendations** Update Telenia Software TVox to a version later than 26.5.3. Update Telenia Software TVox to a version later than 24.9.21.

**Name of the Vulnerable Software and Affected Versions** Telenia Software TVox versions prior to 26.5.4 Telenia Software TVox versions prior to 24.9.22 **Description** Authenticated attackers can execute arbitrary operating system commands with the privileges of the apache user. This occurs in the 'action audio.php' endpoint when the `action` parameter is set to 'checkProcess'. The issue stems from the `exec()` function processing an unsanitized `pid` parameter, allowing for OS command injection. **Recommendations** Update Telenia Software TVox to version 26.5.4 or later. Update Telenia Software TVox to version 24.9.22 or later. As a temporary mitigation, restrict access to the 'action audio.php' endpoint or avoid using the `pid` parameter when the `action` is set to 'checkProcess'.

**Name of the Vulnerable Software and Affected Versions** vBulletin versions 5.x through 5.7.5 vBulletin versions 6.x through 6.2.1 **Description** An eval injection issue exists in the `vB5 Template Runtime::runMaths()` method within the template runtime. This occurs because the method processes expressions from the `{vb:math}` template tag and passes them to the PHP `eval()` function. Although a regular expression filter is used to restrict input to mathematical symbols, it is insufficiently restrictive. An unauthenticated remote attacker can bypass this filter using phpfuck-style encoding—a technique of constructing executable code using only permitted characters—to execute arbitrary PHP code on the server. This can be exploited via the unauthenticated `ajax/render` template route, specifically the `ajax/render/pagenav` endpoint, by supplying crafted input through the `pagenav[pagenumber]` parameter. **Recommendations** Update vBulletin to version 6.2.2 or newer. Apply the official vendor patches for versions 6.2.1, 6.2.0, and 6.1.6. For versions 5.x and other unsupported branches, migrate to a supported and patched version. As a temporary mitigation, use a Web Application Firewall (WAF) to block anomalous requests to the `ajax/render/pagenav` endpoint and restrict suspicious values in the `pagenav[pagenumber]` parameter.

**Name of the Vulnerable Software and Affected Versions** Control Web Panel versions prior to 0.9.8.1225 **Description** An unauthenticated remote attacker can execute arbitrary SQL queries due to improper input validation and unsafe SQL query construction. Approximately 896,400 devices worldwide are potentially affected. The issue occurs at the 'user' endpoint through the `userRes` POST parameter. By exploiting MySQL root privileges, an attacker can use the INTO DUMPFILE command to write a PHP webshell into the web-accessible Roundcube logs directory, resulting in remote code execution as the `cwpsvc` account and potential full server compromise. **Recommendations** Upgrade to version 0.9.8.1225. As a temporary workaround, restrict access to the 'user' endpoint or avoid using the `userRes` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Discuz! X5.0 versions 20260320 through 20260610 **Description** An issue exists where authenticated administrators can execute arbitrary code by importing a specially crafted plugin configuration. This is achieved by including path traversal sequences in the `directory` attribute. By triggering an exception during plugin installation, sanitization routines are bypassed, allowing malicious paths to be stored and subsequently passed to the `include()` function. When combined with file upload functionality, this leads to arbitrary code execution within the context of the web server user. **Recommendations** Update Discuz! X5.0 to a version released after 20260610.

**Name of the Vulnerable Software and Affected Versions** Discuz! X5.0 versions 20260320 through 20260610 **Description** A CAPTCHA bypass allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition (OCR) model—a technology that converts images of text into machine-encoded text—against collected samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse. **Recommendations** Update to a version later than 20260610.

**Name of the Vulnerable Software and Affected Versions** Discuz! X5.0 versions 20260320 through 20260501 **Description** An authentication bypass allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality. This is possible due to a shared cryptographic key between UCenter integration and the database backup API exposed by the 'dbbak.php' endpoint. Attackers can inject a crafted payload through the `username` parameter during login to abuse the encryption oracle in the `logging more()` function within `logging ctl`, enabling them to obtain a signed token. This token allows the bypass of authorization for database export and import operations, and a race condition can be triggered to impersonate arbitrary users. **Recommendations** For versions 20260320 through 20260501, apply the available patch to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SocialEngine versions 7.8.0 and prior **Description** An issue exists in the '/activity/index/get-memberall' endpoint where user-supplied input passed via the `text` parameter is not sanitized before being incorporated into a SQL query. This allows an unauthenticated remote attacker to read arbitrary data from the database, reset administrator account passwords, and gain unauthorized access to the Packages Manager in the Admin Panel, which could potentially enable remote code execution. **Recommendations** Update SocialEngine to a version later than 7.8.0. Avoid using the `text` parameter in the '/activity/index/get-memberall' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SocialEngine versions prior to 7.8.1 **Description** A blind server-side request forgery exists in the "/core/link/preview" endpoint. The issue occurs because user-supplied input passed via the `uri` request parameter is not sanitized before being used to construct outbound HTTP requests. Authenticated remote attackers can provide arbitrary URLs, including internal network and loopback addresses, forcing the server to issue HTTP requests to attacker-controlled destinations. This allows for internal network enumeration and access to services not intended to be externally reachable. **Recommendations** Update to a version later than 7.8.0. As a temporary workaround, restrict access to the "/core/link/preview" endpoint or avoid using the `uri` parameter until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** MailEnable versions prior to 10.55 **Description** The software contains a reflected cross-site scripting issue in the webmail interface. Remote attackers can execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the `StartDate` parameter in the `FreeBusy.aspx` form, which is not properly sanitized before being embedded into dynamically generated JavaScript. **Recommendations** Update to version 10.55 or later.

**Name of the Vulnerable Software and Affected Versions** MailEnable versions prior to 10.55 **Description** The software contains a reflected cross-site scripting issue in the webmail interface. This allows remote attackers to execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the `Attendees` parameter in the `FreeBusy.aspx` form, which is not properly sanitized before being embedded into dynamically generated JavaScript. **Recommendations** Update MailEnable to version 10.55 or later.

**Name of the Vulnerable Software and Affected Versions** MailEnable versions prior to 10.55 **Description** The software contains a reflected cross-site scripting issue in the webmail interface. This allows remote attackers to execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the `SelectedIndex` parameter in the `ManageShares.aspx` form, which is not properly sanitized before being included in dynamically generated JavaScript. **Recommendations** Update MailEnable to version 10.55 or later.

**Name of the Vulnerable Software and Affected Versions** MetInfo CMS versions 7.9 through 8.1 **Description** An unauthenticated PHP code injection flaw exists due to insufficient input neutralization in the execution path, specifically within the `wxAdminLogin()` function and the file `/app/system/weixin/include/class/weixinreply.class.php`. This issue affects the handling of Weixin (WeChat) API requests. Remote attackers can execute arbitrary code and gain full control over the affected server by sending crafted requests containing malicious PHP code. This exploitation is possible on non-Windows servers where the `/cache/weixin/` directory exists, which occurs when the official WeChat plugin is installed and configured. Real-world exploitation has been observed, with a significant surge in activity starting May 1, 2026, primarily targeting approximately 2,000 online instances in China and Hong Kong, as well as some honeypots in the U.S. and Singapore. **Recommendations** Update MetInfo CMS versions 7.9, 8.0, and 8.1 to the patched versions released on April 7, 2026. As a temporary workaround, restrict access to the WeChat API component or the `/app/system/weixin/include/class/weixinreply.class.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Blesta versions 3.x through 5.x before 5.13.3 **Description** The software contains a flaw that allows for object injection. This issue is also known as CORE-5680. **Recommendations** Update to version 5.13.3 or later.

**Name of the Vulnerable Software and Affected Versions** Blesta versions 3.x through 5.x before 5.13.3 **Description** The software contains a flaw that allows for object injection. This issue is also identified as CORE-5668. **Recommendations** Update to version 5.13.3 or later.

**Name of the Vulnerable Software and Affected Versions** Blesta versions 3.x through 5.x before 5.13.3 **Description** The software does not properly validate input. This could allow for potential issues related to data handling. **Recommendations** Update to version 5.13.3 or later.

**Name of the Vulnerable Software and Affected Versions** SmarterTools SmarterMail versions prior to 9526 **Description** SmarterTools SmarterMail is susceptible to a cross-site scripting (XSS) issue through MAPI requests. The issue allows for the injection of malicious scripts via crafted MAPI requests. **Recommendations** Update SmarterTools SmarterMail to version 9526 or later.

Name of the Vulnerable Software and Affected Versions: SugarCRM versions prior to 6.5.24 SugarCRM versions prior to 6.7.13 SugarCRM versions prior to 7.5.2.5 SugarCRM versions prior to 7.6.2.2 SugarCRM versions prior to 7.7.1.0 Description: A PHP object injection issue exists due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the `rest data` parameter before passing it to the `unserialize()` function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. A prior fix was incomplete and failed to address some vectors. Recommendations: For versions prior to 6.5.24, update to version 6.5.24 or later. For versions prior to 6.7.13, update to version 6.7.13 or later. For versions prior to 7.5.2.5, update to version 7.5.2.5 or later. For versions prior to 7.6.2.2, update to version 7.6.2.2 or later. For versions prior to 7.7.1.0, update to version 7.7.1.0 or later. As a temporary workaround, consider disabling the `unserialize()` function for the `rest data` parameter in the SugarRestSerialize.php script until a patch is available.

Name of the Vulnerable Software and Affected Versions: Invision Community versions 5.0.0 through 5.0.7 Description: The issue lies within the themeeditor controller, where a protected method named `customCss` can be invoked by unauthenticated users. This method passes the value of the `content` parameter to the `Theme::makeProcessFunction()` method, which is evaluated by the template engine. As a result, unauthenticated attackers can exploit this to inject and execute arbitrary PHP code by providing crafted template strings to the `/applications/core/modules/front/system/themeeditor.php` file. Recommendations: For Invision Community versions 5.0.0 through 5.0.7, update to a version later than 5.0.7 to resolve the issue. As a temporary workaround, consider disabling the `customCss` method in the themeeditor controller until a patch is available. Restrict access to the themeeditor controller to minimize the risk of exploitation.