Egidio Romano

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password.

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP SELF and skips authentication when the value matches 'login admin.php'. Attackers can append '/login admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.

**Name of the Vulnerable Software and Affected Versions** vBulletin versions 5.x through 5.7.5 vBulletin versions 6.x through 6.2.1 **Description** An eval injection issue exists in the `vB5 Template Runtime::runMaths()` function within the template runtime. Unauthenticated remote attackers can execute arbitrary PHP code by providing crafted input through the `pagenav[pagenumber]` parameter via the `ajax/render` template route. This is possible because the regex filter is insufficiently restrictive, allowing the use of phpfuck-style encoding—a technique used to bypass filters by using alternative character representations—to inject code. **Recommendations** Update vBulletin versions 5.x through 5.7.5 to a version newer than 5.7.5. Update vBulletin versions 6.x through 6.2.1 to a version newer than 6.2.1.

**Name of the Vulnerable Software and Affected Versions** Control Web Panel versions prior to 0.9.8.1225 **Description** An unauthenticated remote attacker can execute arbitrary SQL queries due to improper input validation and unsafe SQL query construction. Approximately 896,400 devices worldwide are potentially affected. The issue occurs at the 'user' endpoint through the `userRes` POST parameter. By exploiting MySQL root privileges, an attacker can use the INTO DUMPFILE command to write a PHP webshell into the web-accessible Roundcube logs directory, resulting in remote code execution as the `cwpsvc` account and potential full server compromise. **Recommendations** Upgrade to version 0.9.8.1225. As a temporary workaround, restrict access to the 'user' endpoint or avoid using the `userRes` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Discuz! X5.0 versions 20260320 through 20260610 **Description** An issue exists where authenticated administrators can execute arbitrary code by importing a specially crafted plugin configuration. This is achieved by including path traversal sequences in the `directory` attribute. By triggering an exception during plugin installation, sanitization routines are bypassed, allowing malicious paths to be stored and subsequently passed to the `include()` function. When combined with file upload functionality, this leads to arbitrary code execution within the context of the web server user. **Recommendations** Update Discuz! X5.0 to a version released after 20260610.

**Name of the Vulnerable Software and Affected Versions** Discuz! X5.0 versions 20260320 through 20260610 **Description** A CAPTCHA bypass allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition (OCR) model—a technology that converts images of text into machine-encoded text—against collected samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse. **Recommendations** Update to a version later than 20260610.

**Name of the Vulnerable Software and Affected Versions** Discuz! X5.0 versions 20260320 through 20260501 **Description** An authentication bypass allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality. This is possible due to a shared cryptographic key between UCenter integration and the database backup API exposed by the 'dbbak.php' endpoint. Attackers can inject a crafted payload through the `username` parameter during login to abuse the encryption oracle in the `logging more()` function within `logging ctl`, enabling them to obtain a signed token. This token allows the bypass of authorization for database export and import operations, and a race condition can be triggered to impersonate arbitrary users. **Recommendations** For versions 20260320 through 20260501, apply the available patch to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SocialEngine versions 7.8.0 and prior **Description** An issue exists in the '/activity/index/get-memberall' endpoint where user-supplied input passed via the `text` parameter is not sanitized before being incorporated into a SQL query. This allows an unauthenticated remote attacker to read arbitrary data from the database, reset administrator account passwords, and gain unauthorized access to the Packages Manager in the Admin Panel, which could potentially enable remote code execution. **Recommendations** Update SocialEngine to a version later than 7.8.0. Avoid using the `text` parameter in the '/activity/index/get-memberall' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** SocialEngine versions prior to 7.8.1 **Description** A blind server-side request forgery exists in the "/core/link/preview" endpoint. The issue occurs because user-supplied input passed via the `uri` request parameter is not sanitized before being used to construct outbound HTTP requests. Authenticated remote attackers can provide arbitrary URLs, including internal network and loopback addresses, forcing the server to issue HTTP requests to attacker-controlled destinations. This allows for internal network enumeration and access to services not intended to be externally reachable. **Recommendations** Update to a version later than 7.8.0. As a temporary workaround, restrict access to the "/core/link/preview" endpoint or avoid using the `uri` parameter until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** MailEnable versions prior to 10.55 **Description** The software contains a reflected cross-site scripting issue in the webmail interface. Remote attackers can execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the `StartDate` parameter in the `FreeBusy.aspx` form, which is not properly sanitized before being embedded into dynamically generated JavaScript. **Recommendations** Update to version 10.55 or later.

**Name of the Vulnerable Software and Affected Versions** MailEnable versions prior to 10.55 **Description** The software contains a reflected cross-site scripting issue in the webmail interface. This allows remote attackers to execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the `Attendees` parameter in the `FreeBusy.aspx` form, which is not properly sanitized before being embedded into dynamically generated JavaScript. **Recommendations** Update MailEnable to version 10.55 or later.

**Name of the Vulnerable Software and Affected Versions** MailEnable versions prior to 10.55 **Description** The software contains a reflected cross-site scripting issue in the webmail interface. This allows remote attackers to execute arbitrary JavaScript in a victim’s browser by using a malicious URL. Attackers can inject malicious code through the `SelectedIndex` parameter in the `ManageShares.aspx` form, which is not properly sanitized before being included in dynamically generated JavaScript. **Recommendations** Update MailEnable to version 10.55 or later.

**Name of the Vulnerable Software and Affected Versions** MetInfo CMS versions 7.9 through 8.1 **Description** An unauthenticated PHP code injection flaw exists due to insufficient input neutralization in the execution path, specifically within the `wxAdminLogin()` function and the file `/app/system/weixin/include/class/weixinreply.class.php`. This issue affects the handling of Weixin (WeChat) API requests. Remote attackers can execute arbitrary code and gain full control over the affected server by sending crafted requests containing malicious PHP code. This exploitation is possible on non-Windows servers where the `/cache/weixin/` directory exists, which occurs when the official WeChat plugin is installed and configured. Real-world exploitation has been observed, with a significant surge in activity starting May 1, 2026, primarily targeting approximately 2,000 online instances in China and Hong Kong, as well as some honeypots in the U.S. and Singapore. **Recommendations** Update MetInfo CMS versions 7.9, 8.0, and 8.1 to the patched versions released on April 7, 2026. As a temporary workaround, restrict access to the WeChat API component or the `/app/system/weixin/include/class/weixinreply.class.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Blesta versions 3.x through 5.x before 5.13.3 **Description** The software contains a flaw that allows for object injection. This issue is also known as CORE-5680. **Recommendations** Update to version 5.13.3 or later.

**Name of the Vulnerable Software and Affected Versions** Blesta versions 3.x through 5.x before 5.13.3 **Description** The software contains a flaw that allows for object injection. This issue is also identified as CORE-5668. **Recommendations** Update to version 5.13.3 or later.

**Name of the Vulnerable Software and Affected Versions** Blesta versions 3.x through 5.x before 5.13.3 **Description** The software does not properly validate input. This could allow for potential issues related to data handling. **Recommendations** Update to version 5.13.3 or later.

**Name of the Vulnerable Software and Affected Versions** SmarterTools SmarterMail versions prior to 9526 **Description** SmarterTools SmarterMail is susceptible to a cross-site scripting (XSS) issue through MAPI requests. The issue allows for the injection of malicious scripts via crafted MAPI requests. **Recommendations** Update SmarterTools SmarterMail to version 9526 or later.

Name of the Vulnerable Software and Affected Versions: SugarCRM versions prior to 6.5.24 SugarCRM versions prior to 6.7.13 SugarCRM versions prior to 7.5.2.5 SugarCRM versions prior to 7.6.2.2 SugarCRM versions prior to 7.7.1.0 Description: A PHP object injection issue exists due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the `rest data` parameter before passing it to the `unserialize()` function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. A prior fix was incomplete and failed to address some vectors. Recommendations: For versions prior to 6.5.24, update to version 6.5.24 or later. For versions prior to 6.7.13, update to version 6.7.13 or later. For versions prior to 7.5.2.5, update to version 7.5.2.5 or later. For versions prior to 7.6.2.2, update to version 7.6.2.2 or later. For versions prior to 7.7.1.0, update to version 7.7.1.0 or later. As a temporary workaround, consider disabling the `unserialize()` function for the `rest data` parameter in the SugarRestSerialize.php script until a patch is available.

Name of the Vulnerable Software and Affected Versions: Invision Community versions 5.0.0 through 5.0.7 Description: The issue lies within the themeeditor controller, where a protected method named `customCss` can be invoked by unauthenticated users. This method passes the value of the `content` parameter to the `Theme::makeProcessFunction()` method, which is evaluated by the template engine. As a result, unauthenticated attackers can exploit this to inject and execute arbitrary PHP code by providing crafted template strings to the `/applications/core/modules/front/system/themeeditor.php` file. Recommendations: For Invision Community versions 5.0.0 through 5.0.7, update to a version later than 5.0.7 to resolve the issue. As a temporary workaround, consider disabling the `customCss` method in the themeeditor controller until a patch is available. Restrict access to the themeeditor controller to minimize the risk of exploitation.