Tag: remote-code-execution
-
Severe vBulletin Flaw Allows Remote Code Execution by Attackers
A newly discovered vulnerability in vBulletin, one of the world’s most popular commercial forum platforms, has highlighted the dangers of relying on method visibility for security. The flaw, affecting vBulletin versions 5.x and 6.x running on PHP 8.1 or later, allowed attackers to invoke protected methods remotely, without authentication, thanks to a subtle but significant…
-
Apache Tomcat RCE Vulnerability Exposed with PoC Released
Tags: apache, container, control, cve, cyber, data-breach, flaw, malicious, open-source, rce, remote-code-execution, vulnerabilityA critical security vulnerability, tracked as CVE-2025-24813, has been discovered in Apache Tomcat, a widely used open-source Java servlet container and web server. This flaw, stemming from improper handling of file paths, particularly those containing internal dots (e.g., file.Name)”, can allow attackers to bypass security controls, leading to remote code execution (RCE), information disclosure, and…
-
Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability
Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile (EPMM) version 12.5.0.0 and earlier. These flaws, when chained together, allow unauthenticated remote code execution (RCE) on internet-facing systems, posing a severe risk to enterprise security. EclecticIQ analysts have confirmed active exploitation in the wild since the disclosure date, with…
-
Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000
A threat actor known as #LongNight has reportedly put up for sale remote code execution (RCE) access to Burger King Spain’s backup system, leveraging vulnerabilities in the AhsayCBS platform. Priced at $4,000, this exploit offers malicious actors a potential gateway to compromise a critical infrastructural component of the fast-food giant’s operations in Spain. 4 The…
-
Critical Vulnerabilities Found in Versa Networks SD-WAN/SASE Platform
The unpatched vulnerabilities, with a CVSS score of 8.6 to 10.0, can lead to remote code execution via authentication bypass First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/critical-zerodays-versa-networks/
-
Fortinet Zero-Day Under Attack: PoC Now Publicly Available
Tags: advisory, api, attack, cve, cyber, flaw, fortinet, remote-code-execution, vulnerability, zero-dayFortiGuard Labs released an urgent advisory detailing a critical vulnerability, CVE-2025-32756, affecting several Fortinet products, including FortiCamera, FortiMail, FortiNDR, FortiRecorder, and FortiVoice. The vulnerability is a stack-based buffer overflow located within the administrative API, specifically in the handling of session cookies. This flaw allows for unauthenticated remote code execution, making it a prime target for…
-
Critical Vulnerability in Netwrix Password Manager Enables Authenticated Remote Code Execution
A critical security vulnerability has been discovered in Netwrix Password Secure, a widely used enterprise password management solution, potentially allowing authenticated attackers to execute remote code on other users’ systems. Identified in versions up to 9.2.2, including the specific build 9.2.0.32454 for both client (PSC) and server (PSS) components, this flaw poses a significant risk…
-
Cityworks Zero-Day Vulnerability Used by UAT-638 Hackers to Infect IIS Servers with Shell Malware
Cisco Talos has uncovered active exploitation of a zero-day remote-code-execution vulnerability, identified as CVE-2025-0994, in Cityworks, a widely used asset management system. This critical flaw has been leveraged by a group tracked as UAT-6382, assessed with high confidence to be Chinese-speaking threat actors, to target enterprise networks of local governing bodies in the United States…
-
Chinese Hackers Exploit Trimble Cityworks Flaw to Infiltrate U.S. Government Networks
Tags: access, china, cisco, cve, exploit, flaw, government, hacker, malware, network, remote-code-execution, threat, vulnerabilityA Chinese-speaking threat actor tracked as UAT-6382 has been linked to the exploitation of a now-patched remote-code-execution vulnerability in Trimble Cityworks to deliver Cobalt Strike and VShell.”UAT-6382 successfully exploited CVE-2025-0944, conducted reconnaissance, and rapidly deployed a variety of web shells and custom-made malware to maintain long-term access,” Cisco Talos researchers First seen on thehackernews.com Jump…
-
Ivanti EPMM flaw exploited by Chinese hackers to breach govt agencies
Tags: breach, china, endpoint, exploit, flaw, government, hacker, ivanti, mobile, remote-code-executionChinese hackers have been exploiting a remote code execution flaw in Ivanti Endpoint Manager Mobile (EPMM) to breach high-profile organizations worldwide. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ivanti-epmm-flaw-exploited-by-chinese-hackers-to-breach-govt-agencies/
-
Critical Zero-Days Found in Versa Networks SD-WAN/SASE Platform
The unpatched vulnerabilities, with a CVSS score of 8.6 to 10.0, can lead to remote code execution via authentication bypass First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/critical-zerodays-versa-networks/
-
Unpatched critical bugs in Versa Concerto lead to auth bypass, RCE
Critical vulnerabilities in Versa Concerto that are still unpatched could allow remote attackers to bypass authentication and execute arbitrary code on affected systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/unpatched-critical-bugs-in-versa-concerto-lead-to-auth-bypass-rce/
-
Versa Concerto 0-Day Flaw Enables Remote Code Execution by Bypassing Authentication
Tags: authentication, cyber, flaw, government, network, remote-code-execution, risk, service, vulnerability, zero-daySecurity researchers have uncovered multiple critical vulnerabilities in Versa Concerto, a widely deployed network security and SD-WAN orchestration platform used by large enterprises, service providers, and government entities. Despite responsible disclosure efforts over a 90-day period, these vulnerabilities remain unpatched, creating significant risk for organizations using this platform. The issues include authentication bypass flaws, arbitrary…
-
Authenticated Remote Code Execution in Netwrix Password Secure (CVE-2025-26817)
Password managers are considered one of the most secure ways to keep passwords safe. We have analyzed the commercial password manager by Netwrix and discovered an authenticated Remote Code Execution vulnerability. First seen on 8com.de Jump to article: www.8com.de/cyber-security-blog/authenticated-remote-code-execution-in-netwrix-password-secure-cve-2025-26817
-
Ivanti EPMM 0-Day RCE Vulnerability Under Active Attack
Tags: attack, authentication, cyber, endpoint, flaw, ivanti, mobile, rce, remote-code-execution, vulnerability, zero-dayIvanti’s Endpoint Manager Mobile (EPMM) contains a critical vulnerability chain that has been actively abused. The vulnerabilities, initially disclosed by Ivanti on March 13th, 2025, combine an authentication bypass (CVE-2025-4427) and a remote code execution flaw (CVE-2025-4428) to create a critical attack vector that allows unauthenticated attackers to execute arbitrary code on vulnerable systems. While…
-
Critical Vulnerability in Lexmark Printers Enables Remote Code Execution
Security researchers from DEVCORE discovered the vulnerability through Trend Micro’s Zero Day Initiative (ZDI), marking the third major printer firmware flaw disclosed in 2025 following similar incidents affecting HP and Canon devices. Critical security vulnerability affecting over 150 Lexmark printer and multifunction device models enables remote attackers to execute malicious code on unpatched systems through…
-
Ivanti EPMM Bugs Combine for Unauthenticated RCE in the Wild
Summary On March 13, Ivanti disclosed two vulnerabilities which a ect their on-premise Endpoint Manager Mobile product: CVE-2025-4427 (an authentication bypass) and CVE-2025-4428 (an authenticated First seen on research.kudelskisecurity.com Jump to article: research.kudelskisecurity.com/2025/05/21/ivanti-epmm-bugs-combine-for-unauthenticated-rce-in-the-wild/
-
Critical Vulnerability in Palo Alto GlobalProtect Gateway Portal Enables Remote Code Execution
Palo Alto Networks has assigned the vulnerability aLOW severity ratingbut urges administrators to apply patches by upgrading to fixed PAN-OS versions, with timelines extending through August 2025. Reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks’ GlobalProtect gateway and portal features (CVE-2025-0133) has been disclosed, enabling attackers to execute malicious JavaScript in authenticated users’ browsers.…
-
RomethemeKit For Elementor plugin impacted by RCE bug
First seen on scworld.com Jump to article: www.scworld.com/brief/romethemekit-for-elementor-plugin-impacted-by-rce-bug
-
Crawlomatic WordPress plugin patched for critical 9.8 RCE flaw
First seen on scworld.com Jump to article: www.scworld.com/news/crawlomatic-wordpress-plugin-patched-for-critical-98-rce-flaw
-
CISA Adds Actively Exploited Ivanti EPMM Zero-Day to KEV Catalog
Tags: authentication, cisa, cve, cyber, cybersecurity, endpoint, exploit, flaw, infrastructure, ivanti, kev, mobile, open-source, remote-code-execution, vulnerability, zero-dayCybersecurity and Infrastructure Security Agency (CISA) has added two critical zero-day vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The flaws CVE-2025-4427 and CVE-2025-4428 enable authentication bypass and remote code execution, respectively, and stem from insecure implementations of widely used open-source…
-
Active Exploitation of Ivanti EPMM Zero-Day Vulnerability in the Wild
Tags: cve, cyber, exploit, ivanti, monitoring, remote-code-execution, threat, vulnerability, zero-daySecurity researchers at The Shadowserver Foundation have identified active exploitation attempts targeting a critical zero-day vulnerability in Ivanti’s Enterprise Mobility Management (EPMM) platform. The vulnerability, tracked as CVE-2025-4427, can be chained with CVE-2025-4428 to achieve remote code execution (RCE), posing a significant threat to unpatched systems. Recent monitoring shows a concerning number of vulnerable instances…
-
RCE Vulnerability Found in RomethemeKit For Elementor Plugin
RomethemeKit for Elementor has released a patch addressing an RCE vulnerability exposing 30,000 sites First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/rce-vulnerability-in-romethemekit/
-
Confluence Servers Under Attack: Hackers Leverage Vulnerability for RDP Access and Remote Code Execution
Tags: access, attack, breach, cve, cyber, data-breach, exploit, flaw, hacker, injection, network, remote-code-execution, threat, vulnerabilityThreat actors exploited a known vulnerability, CVE-2023-22527, a template injection flaw in Atlassian Confluence servers exposed to the internet. This exploit facilitated remote code execution (RCE), enabling attackers to gain initial access and establish a foothold within targeted networks. The breach, first detected through network traffic from IP address 45.227.254.124 running a >>whoami
-
Critical Firefox 0-Day Flaws Allow Remote Code Execution
Mozilla has urgently patched two critical 0-day vulnerabilities in its popular web browser Firefox, both of which could allow remote attackers to execute malicious code on user systems. The flaws, tracked as CVE-2025-4918 and CVE-2025-4919, were disclosed on May 17, 2025, and are addressed in Firefox version 138.0.4. Security experts are strongly advising all users…
-
Thousands of WordPress Sites at Risk Due to Critical Crawlomatic Plugin Vulnerability
A severe security vulnerability has been discovered in the popular WordPress plugin, Crawlomatic Multisite Scraper Post Generator, potentially placing thousands of websites at risk. Tracked as CVE-2025-4389, the flaw allows unauthenticated attackers to upload malicious files, which could ultimately lead to remote code execution on affected websites. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/crawlomatic-plugin-hit-by-cve-2025-4389/
-
Ivanti Fixes RCE and Auth Bypass Vulnerabilities in Endpoint Manager Mobile
Tags: cve, endpoint, exploit, ivanti, mobile, rce, remote-code-execution, risk, software, vulnerabilityIvanti has released security patches to address two vulnerabilities in its Endpoint Manager Mobile (EPMM) software, which were being actively exploited in limited attacks. These vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, have the potential to allow attackers to execute remote code on vulnerable systems, posing a severe risk to organizations using the software. First seen…
-
Ransomware gangs join ongoing SAP NetWeaver attacks
Ransomware gangs have joined ongoing SAP NetWeaver attacks, exploiting a maximum-severity vulnerability that allows threat actors to gain remote code execution on vulnerable servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ransomware-gangs-join-ongoing-sap-netweaver-attacks/
-
Severe Adobe Illustrator Flaw Allows Remote Code Execution
Adobe has issued an urgent security update for its widely used graphic design software, Adobe Illustrator, following the discovery of a critical heap-based buffer overflow vulnerability tracked as CVE-2025-30330. This flaw, which allows arbitrary code execution on affected systems, impacts both Windows and macOS versions of Illustrator 2024 and 2025. Rated with a CVSS score…