Egidio Romano

An insecure sudoers configuration in `/etc/sudoers.d/telenia` allows attackers with access to the apache account to escalate privileges. The configuration grants the apache user the ability to execute `/bin/nice` with the `NOPASSWD` option, which can be leveraged to invoke arbitrary commands as root without providing a password.

An authentication bypass exists in the `set env.php` file. The `redirectToLoginAdminIRequestHaveAccessToken()` function determines the current page name using the `PHP SELF` variable and fails to require authentication if the value matches 'login admin.php'. An attacker can bypass security checks and gain unauthorized access to all PHP scripts within the manager HTML directory by appending '/login admin.php' to the path of any target PHP script.

Authenticated attackers can execute arbitrary operating system commands with the privileges of the apache user. This occurs in the 'action audio.php' endpoint when the `action` parameter is set to 'checkProcess'. The issue stems from the `exec()` function processing an unsanitized `pid` parameter, allowing for OS command injection.

An eval injection issue exists in the `vB5 Template Runtime::runMaths()` method within the template runtime. This occurs because the method processes expressions from the `{vb:math}` template tag and passes them to the PHP `eval()` function. Although a regular expression filter is used to restrict input to mathematical symbols, it is insufficiently restrictive. An unauthenticated remote attacker can bypass this filter using phpfuck-style encoding—a technique of constructing executable code using only permitted characters—to execute arbitrary PHP code on the server. This can be exploited via the unauthenticated `ajax/render` template route, specifically the `ajax/render/pagenav` endpoint, by supplying crafted input through the `pagenav[pagenumber]` parameter.

An unauthenticated remote attacker can execute arbitrary SQL queries due to improper input validation and unsafe SQL query construction. Approximately 896,400 devices worldwide are potentially affected. The issue occurs at the 'user' endpoint through the `userRes` POST parameter. By exploiting MySQL root privileges, an attacker can use the INTO DUMPFILE command to write a PHP webshell into the web-accessible Roundcube logs directory, resulting in remote code execution as the `cwpsvc` account and potential full server compromise.

An issue exists where authenticated administrators can execute arbitrary code by importing a specially crafted plugin configuration. This is achieved by including path traversal sequences in the `directory` attribute. By triggering an exception during plugin installation, sanitization routines are bypassed, allowing malicious paths to be stored and subsequently passed to the `include()` function. When combined with file upload functionality, this leads to arbitrary code execution within the context of the web server user.

A CAPTCHA bypass allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition (OCR) model—a technology that converts images of text into machine-encoded text—against collected samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.

An authentication bypass allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality. This is possible due to a shared cryptographic key between UCenter integration and the database backup API exposed by the 'dbbak.php' endpoint. Attackers can inject a crafted payload through the `username` parameter during login to abuse the encryption oracle in the `logging more()` function within `logging ctl`, enabling them to obtain a signed token. This token allows the bypass of authorization for database export and import operations, and a race condition can be triggered to impersonate arbitrary users.

An issue exists in the '/activity/index/get-memberall' endpoint where user-supplied input passed via the `text` parameter is not sanitized before being incorporated into a SQL query. This allows an unauthenticated remote attacker to read arbitrary data from the database, reset administrator account passwords, and gain unauthorized access to the Packages Manager in the Admin Panel, which could potentially enable remote code execution.

A blind server-side request forgery exists in the "/core/link/preview" endpoint. The issue occurs because user-supplied input passed via the `uri` request parameter is not sanitized before being used to construct outbound HTTP requests. Authenticated remote attackers can provide arbitrary URLs, including internal network and loopback addresses, forcing the server to issue HTTP requests to attacker-controlled destinations. This allows for internal network enumeration and access to services not intended to be externally reachable.

The software contains a reflected cross-site scripting issue in the webmail interface. Remote attackers can execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the `StartDate` parameter in the `FreeBusy.aspx` form, which is not properly sanitized before being embedded into dynamically generated JavaScript.

The software contains a reflected cross-site scripting issue in the webmail interface. This allows remote attackers to execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the `Attendees` parameter in the `FreeBusy.aspx` form, which is not properly sanitized before being embedded into dynamically generated JavaScript.

The software contains a reflected cross-site scripting issue in the webmail interface. This allows remote attackers to execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the `SelectedIndex` parameter in the `ManageShares.aspx` form, which is not properly sanitized before being included in dynamically generated JavaScript.

An unauthenticated PHP code injection flaw exists due to insufficient input neutralization in the execution path, specifically within the `wxAdminLogin()` function and the file `/app/system/weixin/include/class/weixinreply.class.php`. This issue affects the handling of Weixin (WeChat) API requests. Remote attackers can execute arbitrary code and gain full control over the affected server by sending crafted requests containing malicious PHP code. This exploitation is possible on non-Windows servers where the `/cache/weixin/` directory exists, which occurs when the official WeChat plugin is installed and configured. Real-world exploitation has been observed, with a significant surge in activity starting May 1, 2026, primarily targeting approximately 2,000 online instances in China and Hong Kong, as well as some honeypots in the U.S. and Singapore.

The software contains a flaw that allows for object injection. This issue is also known as CORE-5680.

The software contains a flaw that allows for object injection. This issue is also identified as CORE-5668.

The software does not properly validate input. This could allow for potential issues related to data handling.

SmarterTools SmarterMail is susceptible to a cross-site scripting (XSS) issue through MAPI requests. The issue allows for the injection of malicious scripts via crafted MAPI requests.

Name of the Vulnerable Software and Affected Versions: SugarCRM versions prior to 6.5.24 SugarCRM versions prior to 6.7.13 SugarCRM versions prior to 7.5.2.5 SugarCRM versions prior to 7.6.2.2 SugarCRM versions prior to 7.7.1.0 Description: A PHP object injection issue exists due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the `rest data` parameter before passing it to the `unserialize()` function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. A prior fix was incomplete and failed to address some vectors. Recommendations: For versions prior to 6.5.24, update to version 6.5.24 or later. For versions prior to 6.7.13, update to version 6.7.13 or later. For versions prior to 7.5.2.5, update to version 7.5.2.5 or later. For versions prior to 7.6.2.2, update to version 7.6.2.2 or later. For versions prior to 7.7.1.0, update to version 7.7.1.0 or later. As a temporary workaround, consider disabling the `unserialize()` function for the `rest data` parameter in the SugarRestSerialize.php script until a patch is available.

Name of the Vulnerable Software and Affected Versions: Invision Community versions 5.0.0 through 5.0.7 Description: The issue lies within the themeeditor controller, where a protected method named `customCss` can be invoked by unauthenticated users. This method passes the value of the `content` parameter to the `Theme::makeProcessFunction()` method, which is evaluated by the template engine. As a result, unauthenticated attackers can exploit this to inject and execute arbitrary PHP code by providing crafted template strings to the `/applications/core/modules/front/system/themeeditor.php` file. Recommendations: For Invision Community versions 5.0.0 through 5.0.7, update to a version later than 5.0.7 to resolve the issue. As a temporary workaround, consider disabling the `customCss` method in the themeeditor controller until a patch is available. Restrict access to the themeeditor controller to minimize the risk of exploitation.