Posted by Bryan Ramirez via Fulldisclosure on Oct 15

Advisory ID: VESTACP-2026-001 / GHSA-m2mc-xwq7-pw72
Product: Vesta Control Panel (VestaCP)
Versions: <= 0.9.8-26 (unmaintained since 2019-09; no upstream fix exists)
Severity: Critical - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9
CWE: CWE-78 (OS Command Injection), CWE-95 (Eval Injection)
Reporter: Bryan Ramirez - SYSDOP LLC <security () sysdop com>

SUMMARY
-------
VestaCP stores per-account...

Posted by Matthias Deeg via Fulldisclosure on Oct 15

Advisory ID: SYSS-2026-080
Product: dcm4che
Manufacturer: J4Care
Affected Version(s): 5.35.0
Tested Version(s): 5.35.0
Vulnerability Type: Improper Limitation of a Pathname to a
Restricted Directory (CWE-22)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2026-08-06
Public Disclosure: 2026-10-13
CVE Reference: Not yet...

Posted by Matthias Deeg via Fulldisclosure on Oct 15

Advisory ID: SYSS-2026-079
Product: dcm4che
Manufacturer: J4Care
Affected Version(s): 5.35.0
Tested Version(s): 5.35.0
Vulnerability Type: Improper Limitation of a Pathname to a
Restricted Directory ('Path Traversal') (CWE-22)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2026-08-06
Public Disclosure: 2026-10-13
CVE...

Posted by Matthias Deeg via Fulldisclosure on Oct 15

Advisory ID: SYSS-2026-078
Product: dcm4che
Manufacturer: J4Care
Affected Version(s): 5.35.0
Tested Version(s): 5.35.0
Vulnerability Type: Improper Limitation of a Pathname to a
Restricted Directory ('Path Traversal') (CWE-22)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2026-08-06
Public Disclosure: 2026-10-13
CVE...

Posted by Matthias Deeg via Fulldisclosure on Oct 15

Advisory ID: SYSS-2026-077
Product: dcm4che
Manufacturer: J4Care
Affected Version(s): 5.35.0
Tested Version(s): 5.35.0
Vulnerability Type: Improper Limitation of a Pathname to a
Restricted Directory ('Path Traversal') (CWE-22)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2026-08-06
Public Disclosure: 2026-10-13
CVE...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in Synametrics
Syncrify 6.2 build 1178, the closed-source incremental backup and
file-replication server from Synametrics Technologies, Inc. (United States). The
product is written in Java, distributed for Linux as a tarball archive, and
served by an embedded Tomcat 9.0.113 through the vendor's in-house sradef
framework, whose single front controller routes every request as...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability chain in South
River Technologies Titan MFT Server 26.0.0.364, the NextGen generation of the
commercial managed file transfer server from South River Technologies (Annapolis,
Maryland, United States). The product runs as a single .NET 8 process,
titanmft.exe, registered as the Windows service SrtTitanMFTServerService under
LocalSystem, serves a Blazor Server administration...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in SmartBear
Collaborator Server 15.1.15101, the closed-source peer and technical code-review
platform from SmartBear that runs as a Java web application on Apache Tomcat. One
low-privilege authenticated account plants a Groovy Server Page in the Tomcat
webroot through an archive-extraction path traversal, and any anonymous client -
a crawler, a scanner, anyone - then executes it...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in PacsOne
Server 7.3.9, Premium Edition, Linux x86-64 distribution, the closed-source
commercial PACS (medical imaging archive and DICOM server) from RainbowFish
Software, California, United States. The product combines a native C++ DICOM
and HL7 service with a PHP web interface of 204 endpoints running on MySQL
and Apache, fronted by a single Apache alias that maps /pacsone to...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal
2.1, the self-hosted PHP shopping-cart script from Maian Media (United Kingdom),
oriented at PayPal checkout and distributed as a commercial closed-source archive,
verified end to end against a real installation of that version in three
independent reproductions.

Type: unrestricted upload of a file with a dangerous type (CWE-434 primary, with
CWE-94 and CWE-693...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in Maian
Guardian 2.1, the self-hosted licensing system for PHP applications encoded
with SourceGuardian, distributed as a closed-source commercial PHP script by
Maian Script World (United Kingdom) and verified end to end against a real
installation of that version.

Type: OS command injection (CWE-78 primary; CWE-116, CWE-20 and CWE-561
contributing; CWE-250 and CWE-732 as...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in Dataedo
Portal 26.2.8 together with Dataedo Agent 26.2.8, the closed-source enterprise
data-catalog and data-governance platform from Dataedo sp. z o.o. (Poland).
Both components are in scope because the chain crosses from one to the other:
the Portal discloses a database credential, and the separately installed Agent
executes an injected scheduler job on its own host. In the...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in CloudPanel
Community Edition 2.5.4-3+clp-bookworm, the closed-source server-management panel
from cloudpanel.io (Germany) that provisions and supervises nginx, php-fpm,
MariaDB and hosted web sites from a Symfony application listening on port 8443.
The build under advisory is the vendor's own distribution package, 69,183,476
bytes, md5 24c36a4739ce065c5c188c89def06f29, on...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability in Auerswald
COMmander 6000 and COMmander 6000R, firmware 8.6D build 128154, the
closed-source enterprise IP-PBX and unified-communications appliances from
Auerswald (Germany). Two unauthenticated HTTP requests, carrying no cookie and
no credential of any kind, yield uid=0(root) gid=0(root) groups=0(root) on an
appliance that holds extension credentials, SIP trunk credentials, call...

Posted by disclosure via Fulldisclosure on Oct 15

0day Rubbish Research Team is publicly disclosing a vulnerability chain in
Abyss Web Server X1 2.16.22.0, the free edition of the closed-source Abyss
web server from Aprelium (Tunisia), a product family that has shipped for
more than twenty years. The release artefacts identify 2.16.22.0 as the
vendor's current official release. Between first start and the moment an
administrator sets a console password, any client admitted by the shipped...

Posted by disclosure via Fulldisclosure on Oct 06

0day Rubbish Research Team is publicly disclosing a vulnerability in
StreamSets Transformer, the Spark-engine data-pipeline platform from
StreamSets Inc. (subsequently acquired by IBM), verified on version 3.17.0
analysed from the official container image.

Type: failing-open authentication plus un-sandboxed code injection. On the
web tier, CWE-306 and CWE-1188 with CWE-285 on the authorisation side: when
the effective http.authentication value...

Posted by disclosure via Fulldisclosure on Oct 06

0day Rubbish Research Team is publicly disclosing a vulnerability in RCDevs WebADM
2.4.14, Freeware Edition, the closed-source IAM/MFA management platform from RCDevs
Security SA (Luxembourg) that fronts the vendor's OpenOTP, SpanKey and TiQR
authentication products.

Type: OS command injection (CWE-78, with CWE-20 and CWE-116 contributing, and
CWE-732/CWE-276 and CWE-250 added for two auxiliary conditions). The administrator
console log...

Posted by disclosure via Fulldisclosure on Oct 06

0day Rubbish Research Team is publicly disclosing a vulnerability in Maian
Cart 3.8, the self-hosted PHP shopping-cart system from Maian Media (Maian
Script World), verified end to end against a real installation of that
version.

Type: unrestricted upload of a file with a dangerous type (CWE-434), realized
as OS command execution (CWE-78) through an attacker-supplied PHP webshell,
with CWE-269 bearing on the execution privilege context. The...

Posted by disclosure via Fulldisclosure on Oct 06

0day Rubbish Research Team is publicly disclosing a vulnerability in
IPConfigure Orchid VMS, installed as Orchid Recorder, version 26.3.0.

Type: OS command injection (CWE-78, with CWE-20 bearing on it because no
character validation exists anywhere on the path; CWE-250 bears on the
result). The server property package.dnf.repo.gpg_key, the URL or path of
the GPG key signing the vendor RPM repository, is written through the
authenticated...

Posted by disclosure via Fulldisclosure on Oct 06

0day Rubbish Research Team is publicly disclosing a vulnerability in the pwrstudio
daemon shipped in Circutor LineEds (Line Energy Data System) industrial energy gateway
firmware 24.11.14-r0, engine variant pss0. Circutor S.A. is in Spain; the appliance sits
between metering and power-quality instrumentation on one side and an energy-management
or SCADA back office on the other.

Type: operating-system command injection (CWE-78) reached without...