Mercredi 16 septembre 2026

phpList

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.

SourceCodester Inventory and Monitoring System

A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments/databank/btn_functions.php?action=add. Performing a manipulation of the argument difficulty_id results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

SourceCodester Inventory and Monitoring System

A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

WuzhiCMS

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

code-projects Matrimonial System

A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. This manipulation of the argument sex/mothertongue/maritialstatus/country/state/religion/agemin/agemax causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

reactphp http

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every iteration. An incomplete terminal-chunk trailer without CRLF left the buffer unchanged after strpos returned false, and exactly two non-CRLF bytes after a completed non-terminal chunk bypassed both the error and wait guards. The affected decoder processes request bodies for React\Http\HttpServer and response bodies for React\Http\Browser, allowing a malicious client to freeze a server or a malicious or compromised server to freeze a client. A reverse proxy that normalizes inbound requests may protect the server direction but does not protect outbound Browser requests. This issue is fixed in version 1.11.1.

Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 · Pepperl+Fuchs ICE2-8IOL-K45S-RJ45

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.

Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 · Pepperl+Fuchs ICE2-8IOL-K45S-RJ45

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.

Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 · Pepperl+Fuchs ICE2-8IOL-K45S-RJ45

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.

Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 · Pepperl+Fuchs ICE2-8IOL-K45S-RJ45

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.

Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 · Pepperl+Fuchs ICE2-8IOL-K45S-RJ45

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.

Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 · Pepperl+Fuchs ICE2-8IOL-K45S-RJ45

A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.

Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 · Pepperl+Fuchs ICE2-8IOL-K45S-RJ45

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.

Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 · Pepperl+Fuchs ICE2-8IOL-K45S-RJ45

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.

Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 · Pepperl+Fuchs ICE2-8IOL-K45S-RJ45

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.

Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-G65L-V1D · Pepperl+Fuchs ICE2-8IOL-K45P-RJ45 · Pepperl+Fuchs ICE2-8IOL-K45S-RJ45

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.

Unknown WP Import Export Lite

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.