Published findings from Evaluris security research, with full references to the official CVE records.
ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution.
Researchers: Adrian Gaitan, Saidakbarxon Maxsudxonov, Reju
Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft.
Researchers: Adrian Gaitan
A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator.
Researchers: Adrian Gaitan
An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation.
Researchers: Adrian Gaitan
sysPass FileBackupService builds a tar shell command by concatenating an administrator-controlled backup directory path into the command line and executing it without proper escaping, enabling authenticated OS command injection.
Researchers: Reju Kole
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates.
Researchers: Reju Kole