High Vulnerabilities
| Primary Vendor — Product |
Description | Published | CVSS Score | Source Info | Patch Info |
|---|---|---|---|---|---|
| acl–ACL Analytics | ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function. Attackers can use bitsadmin to download malicious PowerShell scripts and execute them with system privileges to establish reverse shells and gain complete system control. | 2026-05-17 | 9.8 | CVE-2018-25320 | ExploitDB-44281 Official Product Homepage Product Reference VulnCheck Advisory: ACL Analytics 11.x – 13.0.0.579 Arbitrary Code Execution |
| gitbucket–GitBucket | GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint. | 2026-05-17 | 9.8 | CVE-2018-25332 | ExploitDB-44668 Official Product Homepage Product Reference VulnCheck Advisory: GitBucket 4.23.1 Unauthenticated Remote Code Execution |
| peugeot-music-plugin–Peugeot Music | WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the ‘name’ parameter to execute code from the uploads directory. | 2026-05-17 | 9.8 | CVE-2018-25335 | ExploitDB-44737 VulnCheck Advisory: WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload |
| Paiement–Ecommerce Systempay | Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint, then use SHA1 hash comparison to iteratively test key candidates until discovering the correct production key, enabling them to forge valid payment signatures and manipulate transaction amounts. | 2026-05-13 | 9.8 | CVE-2020-37168 | ExploitDB-48017 Official Product Homepage Product Reference VulnCheck Advisory: Ecommerce Systempay 1.0 Production Key Brute Force |
| Yerootech–iDS6 DSSPro Digital Signage System | iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA se […] Content was cut in order to protect the source.Please visit the source for the rest of the article. This article has been indexed from Bulletins
Read the original article: Post navigation |