---METADATA---
VENDOR: WordPress
PRODUCT: Plugin Download
AFFECTED_VERSIONS: 1.48 and earlier
---END_METADATA---

Description Summary:
An arbitrary file upload vulnerability in the Plugin Download WordPress plugin allows unauthenticated attackers to upload and execute malicious files via the admin-ajax.php endpoint.

Executive Summary:
An unauthenticated arbitrary file upload vulnerability in the WordPress Plugin Download plugin allows attackers to achieve remote code execution by bypassing file extension restrictions.

Vulnerability Details

CVE-ID: CVE-2021-47940

Affected Software: WordPress Plugin Download

Affected Versions: 1.48 and earlier

Vulnerability: This vulnerability occurs in the AJAX fileupload action. Unauthenticated attackers can manipulate the allowExt parameter to bypass security checks and upload executable PHP shells to the web root.

Business Impact

The CVSS score of 9.8 reflects the high probability of total system compromise. By uploading and executing malicious scripts, an attacker can gain administrative access, steal sensitive configuration data, or use the server as a node for further malicious activities.

Remediation Plan

Immediate Action: Update the Plugin Download plugin to the latest version immediately to ensure file extension validation is correctly enforced.

Proactive Monitoring: Monitor server logs for requests to admin-ajax.php that include the download_from_files_617_fileupload action and investigate any suspicious file modifications in the web root.

Compensating Controls: Configure file system permissions to prevent the web server user from executing files uploaded to the plugin's upload directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability provides a straightforward path for attackers to gain execution privileges. Organizations must treat this as a high-priority update and verify that the plugin is fully patched to block unauthorized file uploads.

---METADATA---
VENDOR: ImpressCMS
PRODUCT: ImpressCMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in ImpressCMS 1 that requires immediate investigation and patching.

Executive Summary:
A critical vulnerability in ImpressCMS 1 could allow remote attackers to execute arbitrary code, threatening the entire web application.

Vulnerability Details

CVE-ID: CVE-2021-47938

Affected Software: ImpressCMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the ImpressCMS platform and relates to improper control of code execution paths. Attackers could potentially trigger this flaw to execute unauthorized code on the server, compromising the integrity of the application.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat. Successful exploitation could result in total system compromise, unauthorized data access, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches or upgrade to a secure version of ImpressCMS immediately.

Proactive Monitoring: Review application logs for unauthorized execution of scripts or abnormal system behavior.

Compensating Controls: Deploy a WAF with rules configured to detect and block common web-based exploit attempts and command injection strings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate action. Administrators must prioritize updating ImpressCMS to the latest version to eliminate the risk of remote code execution and protect the underlying infrastructure.

---METADATA---
VENDOR: e107
PRODUCT: e107 CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been discovered in e107 CMS 2 that could permit unauthorized access or code execution.

Executive Summary:
A high-severity vulnerability in e107 CMS 2 presents a significant risk of remote compromise if left unpatched.

Vulnerability Details

CVE-ID: CVE-2021-47937

Affected Software: e107 CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw affects the e107 Content Management System. It likely involves improper handling of input at an endpoint, which could be leveraged by an attacker to execute arbitrary code or bypass security controls.

Business Impact

The CVSS score of 8.8 highlights the severity of this issue. A successful exploit could lead to full site compromise, defacement, or the theft of user data stored within the CMS database.

Remediation Plan

Immediate Action: Upgrade to the latest stable version of e107 CMS as recommended by the vendor.

Proactive Monitoring: Inspect web server logs for indicators of injection attacks, such as unusual URL parameters or encoded payloads.

Compensating Controls: Use a Web Application Firewall (WAF) to block known attack patterns and malicious input signatures targeting CMS platforms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CMS vulnerabilities are frequent targets for automated exploitation. It is imperative to verify the current version of your e107 installation and apply the latest security patches immediately to secure the platform against potential attackers.

---METADATA---
VENDOR: OpenCATS
PRODUCT: OpenCATS
AFFECTED_VERSIONS: 0.9.4
---END_METADATA---

Description Summary:
A remote code execution vulnerability in OpenCATS allows unauthenticated attackers to execute arbitrary system commands by uploading malicious PHP files as resume attachments.

Executive Summary:
An unauthenticated remote code execution vulnerability in OpenCATS allows attackers to gain full control of the server via malicious file uploads disguised as resumes.

Vulnerability Details

CVE-ID: CVE-2021-47936

Affected Software: OpenCATS

Affected Versions: 0.9.4

Vulnerability: This is a remote code execution vulnerability occurring at the careers job application endpoint. Unauthenticated attackers can upload PHP files disguised as resume attachments and execute them by accessing the file path directly.

Business Impact

The CVSS score of 9.8 highlights the critical danger of this vulnerability. Successful exploitation permits attackers to execute system commands, potentially leading to a complete compromise of the underlying host server and access to the applicant database.

Remediation Plan

Immediate Action: Update OpenCATS to the latest version that enforces strict file validation and prevents the execution of uploaded files.

Proactive Monitoring: Check the upload directories for any unexpected PHP files and monitor server access logs for requests targeting these files.

Compensating Controls: Configure the web server to disable script execution in the directory where user-submitted files are stored.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote code execution is among the most severe security risks. Organizations using OpenCATS must apply updates immediately to prevent unauthorized command execution on their servers.

---METADATA---
VENDOR: Sentry
PRODUCT: Sentry
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability has been detected in Sentry 8, potentially impacting the monitoring and error-tracking capabilities of the platform.

Executive Summary:
A high-severity security flaw in Sentry 8 poses a risk to the security of the error-tracking and monitoring platform.

Vulnerability Details

CVE-ID: CVE-2021-47935

Affected Software: Sentry

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the core functionality of Sentry 8, potentially allowing an attacker to manipulate error data or gain unauthorized access.

Business Impact

Sentry is a critical tool for monitoring application health and security. A CVSS score of 8.8 indicates a major security risk; if compromised, an attacker could gain insight into application vulnerabilities or administrative access to the monitoring infrastructure.

Remediation Plan

Immediate Action: Upgrade to the latest supported version of Sentry to remediate the vulnerability.

Proactive Monitoring: Monitor Sentry logs for suspicious administrative actions or unauthorized modifications to error reporting configurations.

Compensating Controls: Use strict network segmentation to ensure the Sentry instance is only accessible by authorized systems.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of Sentry in application oversight, this update should be treated with high urgency. Ensure that all instances of Sentry are updated to the latest version to maintain platform integrity.

---METADATA---
VENDOR: WordPress
PRODUCT: MStore API
AFFECTED_VERSIONS: 2.0.6
---END_METADATA---

Description Summary:
An arbitrary file upload vulnerability in the MStore API allows unauthenticated attackers to execute malicious code on the host server via the REST API.

Executive Summary:
An unauthenticated arbitrary file upload vulnerability in the WordPress MStore API enables remote code execution, posing a critical threat to server integrity.

Vulnerability Details

CVE-ID: CVE-2021-47933

Affected Software: WordPress MStore API

Affected Versions: 2.0.6

Vulnerability: This is an unauthenticated arbitrary file upload vulnerability within the REST API endpoint. Attackers can submit crafted POST requests to the config_file endpoint to upload malicious PHP files and execute arbitrary code.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk of full system compromise. Successful exploitation grants attackers remote code execution capabilities, allowing for complete control over the web server, data exfiltration, and the ability to pivot into the internal network.

Remediation Plan

Immediate Action: Update the MStore API to the latest patched version available from the vendor.

Proactive Monitoring: Inspect the web server's upload directories and system logs for unexpected PHP files or unauthorized POST requests targeting the REST API.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block POST requests containing executable file extensions directed at the REST API endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The critical nature of this remote code execution vulnerability requires immediate attention. Administrators must verify their MStore API version and apply updates immediately to prevent potential server takeover.

---METADATA---
VENDOR: WordPress
PRODUCT: TheCartPress
AFFECTED_VERSIONS: 1.5.3.6
---END_METADATA---

Description Summary:
An unauthenticated privilege escalation vulnerability in TheCartPress WordPress plugin allows attackers to create new administrative accounts via the AJAX handler.

Executive Summary:
An unauthenticated privilege escalation vulnerability in the WordPress TheCartPress plugin allows attackers to gain full administrative control by injecting unauthorized user registration requests.

Vulnerability Details

CVE-ID: CVE-2021-47932

Affected Software: WordPress TheCartPress

Affected Versions: 1.5.3.6

Vulnerability: This is an unauthenticated privilege escalation vulnerability in the tcp_register_and_login_ajax action. Attackers can send crafted POST requests to the AJAX handler with the tcp_role parameter set to "administrator" to create an illicit admin account.

Business Impact

With a CVSS score of 9.8, this flaw allows for immediate and total takeover of the WordPress installation. An attacker with administrative access can modify site content, install malicious plugins, or access sensitive customer data, leading to severe business and privacy impacts.

Remediation Plan

Immediate Action: Update the TheCartPress plugin to the latest version. If a patch is unavailable, deactivate or remove the plugin until a secure version is released.

Proactive Monitoring: Review the site's user list for any unauthorized administrator accounts created recently and check logs for anomalous AJAX requests.

Compensating Controls: Restrict access to the admin-ajax.php file using server-level configuration or a WAF to prevent unauthorized registrations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities are critical and must be remediated immediately. Administrators should audit all existing administrative users to ensure no accounts have been compromised through this vector.

---METADATA---
VENDOR: Balbooa
PRODUCT: Joomla Forms Builder
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw in the Balbooa Joomla Forms Builder may allow an attacker to exploit form submission processes.

Executive Summary:
The Balbooa Forms Builder for Joomla contains a high-severity vulnerability that could lead to unauthorized system impact.

Vulnerability Details

CVE-ID: CVE-2021-47930

Affected Software: Balbooa Joomla Forms Builder

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves improper input sanitization within the forms builder, potentially allowing for arbitrary data submission or system interaction.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a significant risk to Joomla-based sites. Compromise could result in unauthorized data collection or, in certain configurations, remote code execution, leading to full site takeover.

Remediation Plan

Immediate Action: Update the Balbooa Forms Builder to the latest version provided by the developer.

Proactive Monitoring: Monitor for anomalous form submission traffic and check web server logs for suspicious activity.

Compensating Controls: Implement a WAF to monitor and block malformed HTTP requests targeting the form builder components.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Joomla administrators should verify the status of this plugin and apply updates immediately. Given the high severity, ensure that all third-party components are kept up to date to maintain site security.

---METADATA---
VENDOR: OpenCart
PRODUCT: OpenCart
AFFECTED_VERSIONS: 3.0.3.8
---END_METADATA---

Description Summary:
A session fixation vulnerability in OpenCart allows attackers to hijack user sessions by forcing the use of a known, malicious session identifier.

Executive Summary:
A session fixation vulnerability in OpenCart enables attackers to hijack active user sessions, leading to unauthorized account access and potential data theft.

Vulnerability Details

CVE-ID: CVE-2021-47923

Affected Software: OpenCart

Affected Versions: 3.0.3.8

Vulnerability: This is a session fixation vulnerability where an attacker can inject arbitrary values into the OCSESSID cookie. By forcing a specific session ID, the attacker can hijack the session of an unsuspecting user once they authenticate.

Business Impact

The CVSS score of 9.8 indicates the high severity of this session hijacking risk. Successful exploitation allows an attacker to impersonate legitimate users, including administrators, leading to unauthorized access to sensitive account information and backend system controls.

Remediation Plan

Immediate Action: Update OpenCart to the latest version and ensure that the application properly regenerates session IDs upon authentication.

Proactive Monitoring: Monitor server logs for abnormal session activity or multiple logins originating from different IP addresses using the same session cookie.

Compensating Controls: Implement strict session management policies, such as limiting the lifetime of session cookies and ensuring they are flagged as Secure and HttpOnly.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Session fixation remains a potent threat to web applications. Administrators are urged to update their OpenCart installations and audit session handling configurations to mitigate this risk.

Executive Summary:
A high-severity vulnerability, identified as CVE-2021-47918, has been discovered in Simple CMS 2. This flaw could allow a remote, unauthenticated attacker to compromise the affected content management system, potentially leading to unauthorized data access, website defacement, or a complete system takeover. Organizations are urged to apply the vendor-provided security updates immediately to mitigate the significant risk of exploitation.

Vulnerability Details

CVE-ID: CVE-2021-47918

Affected Software: Simple Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific technical details of this vulnerability have not been publicly disclosed, but its high CVSS score of 8.1 suggests a critical flaw. A vulnerability of this severity in a Content Management System (CMS) typically allows for Remote Code Execution (RCE) or critical SQL Injection. An unauthenticated remote attacker could likely exploit this flaw by sending a specially crafted request to a vulnerable system, requiring no user interaction, to execute arbitrary commands, manipulate the underlying database, or upload malicious files.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. Successful exploitation could have a severe impact on the business, leading to the complete compromise of the public-facing website and its underlying server. Potential consequences include theft of sensitive data (such as customer information or intellectual property), service disruption, significant reputational damage, and financial loss. A compromised web server could also be used as a pivot point for launching further attacks against the internal network, escalating the overall security risk to the organization.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor to all affected systems without delay. After patching, administrators should review web server and application access logs for any signs of compromise or attempted exploitation that may have occurred before the patch was applied.

Proactive Monitoring: Implement continuous monitoring of web server logs, looking for unusual or malformed requests, especially those targeting CMS components. Monitor for unexpected file modifications in the web root directory, suspicious outbound network connections originating from the web server, and the creation of any unauthorized administrative accounts within the CMS.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce the risk:

• Place a Web Application Firewall (WAF) in front of the affected application with rules designed to block common attack vectors like RCE and SQLi.
• Restrict access to the CMS administrative portal to trusted IP addresses only.
• Ensure the web server application runs with the principle of least privilege to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of February 2, 2026, there is no known public proof-of-concept exploit code available for this vulnerability, and it is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the high CVSS score, it is highly probable that threat actors will actively research and develop exploits. The lack of current public exploitation should not diminish the urgency of remediation.

Analyst Recommendation

Due to the high severity (CVSS 8.1) of this vulnerability and the critical role of CMS platforms, we recommend that organizations treat this as a high-priority issue. The potential for a remote, unauthenticated attacker to compromise the system presents a significant risk. All organizations using the affected Simple products must prioritize the immediate application of vendor-supplied security patches to prevent potential exploitation.

Executive Summary:
A high-severity SQL Injection vulnerability, identified as CVE-2021-47915, exists in PHP Melody version 3. This flaw allows an unauthenticated remote attacker to execute arbitrary commands on the application's database, potentially leading to a complete compromise of sensitive data, including user credentials and website content. Due to the public availability of exploit code, immediate remediation is critical to prevent data breaches and system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47915

Affected Software: Melody PHP Melody

Affected Versions: PHP Melody version 3.0 and potentially prior versions. See vendor advisory for specific affected versions.

Vulnerability: This vulnerability is a time-based blind SQL Injection flaw. The article.php script fails to properly sanitize user-supplied input in the p parameter before using it in a SQL query. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request containing malicious SQL syntax to the vulnerable parameter, allowing them to infer information from the database by observing the time it takes for the server to respond. This can be used to exfiltrate sensitive data, such as usernames and password hashes, from the database.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. Successful exploitation could have a significant negative impact on the business. An attacker could exfiltrate the entire database, leading to the theft of sensitive user data, intellectual property, and other confidential information. This could result in severe reputational damage, loss of customer trust, regulatory fines (e.g., GDPR, CCPA), and financial losses associated with incident response and recovery. Furthermore, an attacker could potentially modify or delete website data, causing service disruption and impacting business operations.

Remediation Plan

Immediate Action: Apply vendor security updates immediately. All instances of PHP Melody should be upgraded to a patched version as recommended by the vendor. After patching, it is crucial to review access logs for any signs of exploitation that may have occurred prior to remediation.

Proactive Monitoring: Security teams should actively monitor web server and database logs for suspicious activity. Specifically, look for unusual or malformed requests to article.php that contain SQL keywords (e.g., SELECT, UNION, SLEEP, BENCHMARK) within the p parameter. Implement alerts for multiple failed database queries or queries that exhibit abnormally long response times, which could indicate blind SQL injection attempts.

Compensating Controls: If immediate patching is not feasible, deploy a Web Application Firewall (WAF) with a robust ruleset configured to block SQL injection attacks. Additionally, ensure the database user account associated with the PHP Melody application operates with the principle of least privilege, restricting its permissions to only what is absolutely necessary for the application to function. This can limit the impact of a successful exploit.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of February 2, 2026, multiple proof-of-concept (PoC) exploits are publicly available for this vulnerability. The existence of public exploits lowers the barrier for attackers, making it easy for even less-skilled actors to target vulnerable systems. While this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, the availability of a public exploit significantly increases the likelihood of active exploitation attempts.

Analyst Recommendation

Given the high CVSS score, the unauthenticated nature of the attack, and the public availability of exploit code, this vulnerability poses a critical risk to the organization. We strongly recommend that all affected PHP Melody instances be patched immediately. This vulnerability should be treated as a top priority for remediation. Delaying action exposes the organization to a high probability of a data breach and subsequent operational and financial damages.

Executive Summary:
A high-severity SQL Injection vulnerability has been identified in Mult-E-Cart Ultimate 2 software. This flaw allows a remote, unauthenticated attacker to execute malicious commands on the backend database, potentially leading to a complete compromise of sensitive data, including customer information and financial records. Immediate patching is required to prevent data breaches and maintain system integrity.

Vulnerability Details

CVE-ID: CVE-2021-47909

Affected Software: Mult-E-Cart Ultimate 2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a classic SQL Injection flaw. An unauthenticated attacker can send a specially crafted request to the index.php page, manipulating the subcat_id parameter with malicious SQL syntax. Due to insufficient input validation, the application directly incorporates this malicious input into a database query, allowing the attacker to execute arbitrary SQL commands against the backend database.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. Successful exploitation could have severe consequences for the business, including the unauthorized access, modification, or theft of sensitive data such as customer Personally Identifiable Information (PII), credentials, and payment card details. This can lead to significant financial loss, severe reputational damage, and potential regulatory fines for non-compliance with data protection standards like GDPR or PCI-DSS. An attacker could also potentially leverage this access to disrupt business operations by deleting or corrupting critical data.

Remediation Plan

Immediate Action: Apply vendor security updates immediately to patch the vulnerable component. After patching, it is critical to monitor for any ongoing exploitation attempts and conduct a thorough review of web server and database access logs to identify any signs of compromise that may have occurred before the patch was applied.

Proactive Monitoring: Implement robust monitoring of web application traffic. Specifically, look for suspicious GET requests to index.php containing SQL keywords (e.g., UNION, SELECT, ', --) within the subcat_id parameter. Utilize a Web Application Firewall (WAF) to detect and block common SQL injection attack patterns.

Compensating Controls: If immediate patching is not feasible, deploy a WAF with strict rules to filter malicious input targeting the vulnerable subcat_id parameter. Enforce the principle of least privilege by ensuring the web application's database user has the minimum permissions necessary for its operation, thereby limiting the impact of a potential breach.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of February 2, 2026, proof-of-concept (PoC) exploit code for this vulnerability is publicly available. The existence of a public exploit significantly increases the likelihood of attacks by a wide range of threat actors, from automated scanners to targeted attackers. Although not currently listed on the CISA KEV list, its high severity and public exploitability make it an attractive target.

Analyst Recommendation

Given the high CVSS score of 8.1 and the public availability of functional exploit code, this vulnerability presents a critical and immediate risk to the organization. We strongly recommend that the vendor-supplied patch be applied on an emergency basis across all affected systems. Following remediation, a security audit should be conducted to ensure no persistent threats remain from a potential compromise.

Executive Summary:
A high-severity vulnerability exists within PhreeBooks software, allowing an unauthenticated remote attacker to execute arbitrary commands on the underlying database. Successful exploitation could lead to the complete compromise of sensitive data, including financial records and customer information, resulting in significant data breaches and financial loss.

Vulnerability Details

CVE-ID: CVE-2021-47904

Affected Software: PhreeBooks Multiple Products

Affected Versions: PhreeBooks ERP version 5.2.5 and potentially prior versions. See vendor advisory for a complete list.

Vulnerability: This vulnerability is a SQL Injection flaw in the phreebooks.php script. An unauthenticated attacker can send a specially crafted HTTP request to the id parameter of this script. Due to insufficient input validation, the malicious payload is passed directly to the backend database, allowing the attacker to execute arbitrary SQL commands, bypass authentication, and read, modify, or delete any data in the database.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Exploitation could lead to the unauthorized access and exfiltration of highly sensitive business data, such as financial statements, customer Personally Identifiable Information (PII), and proprietary company information. The potential consequences include severe reputational damage, direct financial loss from fraud, regulatory penalties for data privacy violations, and significant disruption to business operations that rely on the integrity of the financial data managed by PhreeBooks.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to all affected PhreeBooks instances without delay. After patching, review web server and database access logs for any indicators of compromise that may have occurred prior to remediation.

Proactive Monitoring: Implement continuous monitoring of web server logs for suspicious requests targeting phreebooks.php, specifically looking for SQL injection syntax (e.g., single quotes, UNION, SELECT, comments) within the id parameter. Monitor database logs for unusual or unauthorized queries originating from the web application's service account. Utilize a Web Application Firewall (WAF) to detect and block SQL injection attempts in real-time.

Compensating Controls: If immediate patching is not feasible, deploy a WAF with strict rules specifically configured to block SQL injection attacks against the PhreeBooks application. Restrict network access to the application, allowing connections only from trusted IP addresses. Ensure the database user account used by the application operates with the principle of least privilege to limit the potential damage of a successful exploit.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of January 25, 2026, proof-of-concept (PoC) exploit code for this vulnerability is widely and publicly available. This lowers the technical skill required for an attacker to target vulnerable systems. Although this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its high severity and the availability of public exploits make it a prime target for opportunistic and targeted attacks.

Analyst Recommendation

Given the high severity (CVSS 8.8) and the public availability of functional exploit code, this vulnerability poses a critical and immediate risk to the organization. We strongly recommend that the vendor's security updates be applied as a top priority. Until patching is complete, compensating controls must be implemented to mitigate the risk of a data breach. A thorough compromise assessment should also be conducted to identify any potential exploitation that may have already occurred.

Executive Summary:
A high-severity vulnerability has been identified in LiteSpeed Web Server Enterprise 5, posing a significant risk to affected systems. Successful exploitation could allow a remote attacker to compromise the web server, potentially leading to unauthorized code execution, data theft, or complete system takeover. Organizations are urged to apply vendor-supplied security updates immediately to mitigate this critical threat.

Vulnerability Details

CVE-ID: CVE-2021-47903

Affected Software: Web Multiple Products

Affected Versions: LiteSpeed Web Server Enterprise version 5. See vendor advisory for specific affected versions.

Vulnerability: This vulnerability allows a remote, unauthenticated attacker to execute arbitrary code on the target server. The flaw likely exists in a core component responsible for processing incoming web requests. By sending a specially crafted request to a vulnerable LiteSpeed server, an attacker can trigger the vulnerability to gain control over the server process, effectively compromising the entire web application and underlying system.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Exploitation of this flaw could have severe consequences for the business, including the compromise of sensitive data hosted on the server, such as customer information, financial records, or intellectual property. An attacker could deface the website, cause a denial-of-service condition leading to business disruption and revenue loss, or use the compromised server as a pivot point to launch further attacks against the internal network. The potential for reputational damage and regulatory fines is significant.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor immediately. System administrators should prioritize the deployment of these patches across all affected LiteSpeed Web Server instances. After patching, it is crucial to monitor systems for any signs of exploitation attempts that may have occurred prior to the update and to review web server access and error logs for anomalous activity.

Proactive Monitoring: Implement enhanced monitoring on affected servers. Security teams should look for unusual or malformed requests in web server access logs, unexpected outbound network connections from the server, unexplained spikes in CPU or memory utilization, and the presence of suspicious files or processes in the web application's directory.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the risk. These can include deploying a Web Application Firewall (WAF) with virtual patching rules designed to block exploit attempts, restricting access to the server from untrusted IP addresses, and ensuring the web server process runs with the lowest possible privileges to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 25, 2026, there are no public reports of active exploitation in the wild. However, given the high severity score (CVSS 8.8) and the nature of the vulnerability (remote code execution), it is highly likely that threat actors will develop and weaponize an exploit. Organizations should operate under the assumption that an exploit is imminent.

Analyst Recommendation

The high severity of this vulnerability warrants immediate attention and action. Although CVE-2021-47903 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its potential for enabling remote code execution makes it a critical risk to the organization. We strongly recommend that all available vendor patches are applied on an emergency basis. Until patching is complete, the compensating controls and proactive monitoring detailed above should be implemented to reduce the attack surface and improve detection capabilities.

---METADATA---
VENDOR: Dirsearch
PRODUCT: Dirsearch
AFFECTED_VERSIONS: 0.4.1
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
A CSV injection vulnerability in Dirsearch 0.4.1 allows attackers to execute malicious formulas via manipulated server redirects in generated CSV reports.

Executive Summary:
A CSV injection vulnerability in Dirsearch 0.4.1 enables attackers to execute malicious formulas through manipulated reports, posing a risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2021-47901

Affected Software: Dirsearch

Affected Versions: 0.4.1

Vulnerability: This is a CSV injection vulnerability triggered when the user utilizes the --csv-report flag. An attacker can craft malicious server redirects containing Excel formulas, which are then improperly processed by spreadsheet software when the generated report is opened.

Business Impact

While the CVSS score is 9.8, the business impact is primarily focused on the compromise of the client-side environment where the CSV is opened. If security analysts or administrators open these reports in vulnerable spreadsheet applications, they could be subject to unauthorized command execution, leading to local data theft or system compromise.

Remediation Plan

Immediate Action: Update to the latest version of Dirsearch and avoid opening CSV reports from untrusted or unverified sources.

Proactive Monitoring: Review generated CSV files for suspicious formula characters (e.g., =, +, -, @) before importing them into spreadsheet software.

Compensating Controls: Configure spreadsheet software to disable automated macro execution and data connections to prevent the automatic triggering of injected formulas.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Users of Dirsearch should update immediately to address this injection flaw. Organizations should enforce internal policies regarding the handling of exported reports to ensure that sensitive data is not exposed to execution risks during analysis.

Executive Summary:
A critical remote code execution vulnerability exists in Gila CMS versions prior to 2.0.0, allowing unauthenticated attackers to gain complete control of the server. By sending a specially crafted web request with malicious code in the HTTP User-Agent header, an attacker can execute arbitrary commands on the system. This can lead to a full system compromise, data theft, and deployment of malware.

Vulnerability Details

CVE-ID: CVE-2021-47900

Affected Software: Gila CMS

Affected Versions: All versions prior to 2.0.0

Vulnerability: The vulnerability is a Remote Code Execution (RCE) flaw that allows an unauthenticated attacker to inject and execute arbitrary PHP code. The flaw exists in how the application processes HTTP headers, specifically the User-Agent header, for requests sent to the admin endpoint. An attacker can craft a request where the User-Agent header contains a malicious PHP payload (e.g., utilizing shell_exec()). When the Gila CMS application logs or processes this header, it improperly executes the embedded PHP code, leading to the execution of system commands with the privileges of the web server process.

Business Impact

This vulnerability is rated as critical with a CVSS score of 9.8, representing a severe risk to the organization. A successful exploit grants an attacker complete control over the affected web server, which can lead to theft of sensitive data, website defacement, service disruption, or the installation of ransomware. The compromised server could also be used as a foothold to launch further attacks against the internal network, escalating the incident's impact. This poses a significant threat to business operations, data confidentiality, and organizational reputation.

Remediation Plan

Immediate Action: The primary remediation is to immediately upgrade all instances of Gila CMS to version 2.0.0 or the latest available version. After patching, it is critical to review web server access logs for any signs of prior exploitation, such as unusual requests to the admin endpoint or suspicious User-Agent strings.

Proactive Monitoring: Implement continuous monitoring of web server access logs, specifically looking for requests with malicious-looking User-Agent strings containing PHP functions like shell_exec(), system(), passthru(), or eval(). Monitor for unexpected outbound network connections from the web server and use file integrity monitoring (FIM) to detect unauthorized changes to application files.

Compensating Controls: If patching is not immediately possible, deploy a Web Application Firewall (WAF) with rules to inspect and block malicious payloads within HTTP headers. Restrict access to the Gila CMS admin endpoint (/admin) to trusted IP addresses only. Ensure the web server process runs with the least privilege necessary to limit the potential impact of a compromise.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jan 27, 2026, proof-of-concept (PoC) exploit code is publicly available for this vulnerability. The ease of exploitation (requiring no authentication) and the high impact make it a prime target for opportunistic attackers. Although this CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, any internet-facing, unpatched Gila CMS instance should be considered at immediate risk of compromise.

Analyst Recommendation

Given the critical severity (CVSS 9.8) of this unauthenticated remote code execution vulnerability and the public availability of exploit code, immediate action is imperative. Organizations must prioritize patching all vulnerable Gila CMS instances to version 2.0.0 or later without delay. Due to the high likelihood of automated scanning and exploitation, all internet-facing installations should be considered compromised until patched and thoroughly investigated for indicators of compromise.

---METADATA---
VENDOR: Unified Remote
PRODUCT: Unified Remote
AFFECTED_VERSIONS: 3.9.0.2463
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
Unified Remote 3.9.0.2463 is susceptible to remote code execution by sending crafted network packets to port 9512.

Executive Summary:
A critical remote code execution vulnerability in Unified Remote allows attackers to execute arbitrary system commands by sending malicious packets to the service.

Vulnerability Details

CVE-ID: CVE-2021-47891

Affected Software: Unified Remote Unified Remote

Affected Versions: 3.9.0.2463

Vulnerability: This vulnerability allows unauthenticated attackers to send specially crafted network packets to port 9512. This triggers the service to open a command prompt, enabling the attacker to download and execute arbitrary malicious payloads on the host system.

Business Impact

The CVSS score of 9.8 reflects the high risk of total system compromise. An attacker exploiting this flaw gains the ability to execute code with the permissions of the service, potentially leading to complete host takeover, installation of persistent backdoors, and unauthorized access to sensitive data stored on the host machine.

Remediation Plan

Immediate Action: Restrict access to port 9512 via host-based firewalls to prevent unauthorized network connections until a vendor patch is applied.

Proactive Monitoring: Monitor network traffic for unexpected connections to port 9512 and inspect system logs for unusual process execution or command shell activity.

Compensating Controls: Use network segmentation to ensure the affected service is not reachable from untrusted or public-facing networks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to execute arbitrary commands remotely makes this a critical security priority. Organizations should immediately isolate the affected systems from the network, particularly by blocking external access to the vulnerable port, and contact the vendor for the latest security updates to remediate the underlying code execution flaw.

Executive Summary:
A high-severity vulnerability has been identified in Textpattern CMS versions prior to 4.0.0, assigned a CVSS score of 8.8. This flaw could allow a remote attacker to compromise the web server, potentially leading to a complete system takeover, data theft, or service disruption. Organizations using affected versions of Textpattern are at significant risk and should apply security updates immediately.

Vulnerability Details

CVE-ID: CVE-2021-47888

Affected Software: prior Multiple Products

Affected Versions: Textpattern versions prior to 4.0.0

Vulnerability: This vulnerability exists within the Textpattern content management system (CMS). Based on the high CVSS score, the flaw likely allows for remote code execution (RCE) or a critical SQL injection. An unauthenticated remote attacker could potentially exploit this by sending a specially crafted request to the affected server, bypassing security controls to execute arbitrary commands, manipulate the database, or upload malicious files. Successful exploitation does not require user interaction or special privileges, making it a critical threat to internet-facing servers.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. A successful exploit could have a severe impact on the business, including the complete compromise of the web server. Potential consequences include theft of sensitive data (such as customer information, credentials, or intellectual property), website defacement, reputational damage, and financial loss. The compromised server could also be used as a pivot point to launch further attacks against the internal network or to host malicious content.

Remediation Plan

Immediate Action: The primary remediation is to apply the vendor-provided security updates to upgrade Textpattern to version 4.0.0 or a later, patched version. All internet-facing systems running the affected software should be prioritized for immediate patching. After patching, it is crucial to review access and error logs for any signs of compromise that may have occurred before the update was applied.

Proactive Monitoring: Security teams should actively monitor web server logs for unusual or malformed requests, particularly those targeting core application files or plugins. Monitor for unexpected processes running on the server, unauthorized file modifications, and suspicious outbound network traffic. Intrusion Detection Systems (IDS) and Security Information and Event Management (SIEM) systems should be configured with rules to detect potential RCE or SQL injection attempts.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the risk. Deploy a Web Application Firewall (WAF) with rules designed to block common web attack patterns. Restrict administrative access to the Textpattern backend to trusted IP addresses only. Ensure the web application runs with the principle of least privilege to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 25, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the high severity (CVSS 8.8), it is highly probable that proof-of-concept exploits will be developed and released by security researchers or malicious actors. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high CVSS score of 8.8, this vulnerability represents a critical risk to the organization. We strongly recommend that all systems running affected versions of Textpattern be patched immediately without delay. Although there is no evidence of active exploitation at this time, the severity of the vulnerability means that it is a prime target for attackers. Prioritize this patching activity above routine updates to prevent potential server compromise and data breaches.

Executive Summary:
A critical denial of service vulnerability exists in the GeoGebra CAS Calculator application. An attacker can exploit this flaw by simply pasting a long string of text into the input field, which causes a buffer overflow and forces the application to crash. This can lead to a loss of productivity and potential loss of unsaved work for users relying on the software.

Vulnerability Details

CVE-ID: CVE-2021-47875

Affected Software: GeoGebra CAS Calculator Multiple Products

Affected Versions: Version 6.0.631.0 is confirmed to be vulnerable. See vendor advisory for a complete list of specific affected versions.

Vulnerability: The application is susceptible to a buffer overflow condition within its input handling function. When a user pastes an unexpectedly large amount of data (e.g., 8000 repeated characters) into the calculator's input field, the application fails to properly validate the input size. This oversized input overwrites adjacent memory buffers, leading to memory corruption and causing the application to terminate unexpectedly, resulting in a denial of service.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, primarily due to the ease of exploitation and complete loss of availability for the application. Exploitation will immediately crash the GeoGebra application, interrupting user workflows and causing a loss of any unsaved data. For organizations that rely on this software for educational, engineering, or mathematical purposes, this can lead to significant productivity disruptions and operational delays.

Remediation Plan

Immediate Action: Immediately update all instances of GeoGebra CAS Calculator to the latest version provided by the vendor. This is the most effective way to permanently resolve the vulnerability.

Proactive Monitoring: System administrators should monitor application and system event logs for crash reports or unexpected terminations of the GeoGebra.exe process. Any correlation between application crashes and user input actions should be investigated as a potential exploitation attempt.

Compensating Controls: If immediate patching is not feasible, implement user awareness training to advise employees against pasting content from untrusted sources into the application. Application control policies can also be used to restrict the execution of known vulnerable versions of the software until they can be updated.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Jan 21, 2026, the method to trigger this vulnerability is publicly known and trivial to execute, requiring no specialized tools. An attacker only needs to craft a long string of characters and paste it. While the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, its simplicity makes it a potential target for nuisance or disruption attacks.

Analyst Recommendation

Given the critical severity (CVSS 9.8) and the trivial nature of the exploit, it is strongly recommended that organizations prioritize the immediate deployment of the vendor-supplied patches to all affected systems. Although this vulnerability is not listed in the CISA KEV catalog, the low barrier to exploitation presents a significant risk of service disruption. All workstations with GeoGebra CAS Calculator installed should be identified and updated without delay.