---METADATA---
VENDOR: Joomla
PRODUCT: KissGallery Component
AFFECTED_VERSIONS: Joomla! Component KissGallery 1.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Joomla KissGallery component allows unauthenticated attackers to execute arbitrary database queries via the URL path.

Executive Summary:
The Joomla KissGallery component contains a critical SQL injection vulnerability that permits unauthenticated attackers to exfiltrate sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2017-20269

Affected Software: Joomla KissGallery Component

Affected Versions: Joomla! Component KissGallery 1.0.0

Vulnerability: This is a SQL injection vulnerability within the KissGallery component, which lacks proper input sanitization. Unauthenticated remote attackers can inject malicious SQL commands via the URL path to interact directly with the database.

Business Impact

The vulnerability carries a CVSS score of 8.2, indicating a high risk of unauthorized data access and potential database compromise. Successful exploitation could lead to the exposure of sensitive user or system information, resulting in significant reputational damage and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Given the lack of a specific patch version, administrators should disable or uninstall the KissGallery component until a secure update is provided by the vendor.

Proactive Monitoring: Monitor web server access logs for anomalous URL patterns containing SQL syntax or suspicious characters indicative of injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting the application's URL parameters.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 21, 2026, there is no official record of this vulnerability being actively exploited in the wild, despite the availability of public proof-of-concept (PoC) code. The high CVSS score and the ability for unauthenticated access make this a significant risk.

Analyst Recommendation

Due to the severity of this unauthenticated SQL injection flaw, immediate action is required to secure the environment. Organizations currently utilizing the KissGallery component should prioritize removing the vulnerable code until a vendor-supplied patch is verified and applied.

---METADATA---
VENDOR: Joomla
PRODUCT: Zap Calendar Lite
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability exists within the Zap Calendar Lite component for Joomla, potentially allowing unauthorized data access or remote exploitation.

Executive Summary:
The Zap Calendar Lite component for Joomla is vulnerable to a flaw that could allow an attacker to compromise the integrity of the web application.

Vulnerability Details

CVE-ID: CVE-2017-20268

Affected Software: Joomla Zap Calendar Lite

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Zap Calendar Lite component for Joomla, which lacks adequate security controls. The vulnerability allows for potential exploitation by an attacker to manipulate or gain unauthorized access to the application data.

Business Impact

The CVSS score of 8.2 underscores the high risk posed by this vulnerability to the confidentiality and integrity of the affected Joomla installation. Exploitation could lead to unauthorized access to event data, user information, or wider system compromise, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the Zap Calendar Lite component to the latest available version provided by the vendor.

Proactive Monitoring: Monitor for anomalous database queries or unusual administrative actions within the Joomla back-end.

Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing known exploit payloads targeting the Zap Calendar component.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high-severity rating and the potential for total application compromise, organizations must treat this vulnerability with extreme urgency. Applying the vendor-provided security patch is the only definitive way to mitigate the risk associated with this component.

---METADATA---
VENDOR: Joomla
PRODUCT: Calendar Planner
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Calendar Planner component for Joomla! is susceptible to a security vulnerability that may facilitate unauthorized access or malicious activity within the web environment.

Executive Summary:
The Joomla! Calendar Planner component contains a high-severity vulnerability that could allow attackers to compromise the security of the underlying web application.

Vulnerability Details

CVE-ID: CVE-2017-20267

Affected Software: Joomla Calendar Planner

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the Calendar Planner component for Joomla!. It likely involves a failure in sanitization or access control, potentially allowing an attacker to manipulate application functionality or access unauthorized data.

Business Impact

With a CVSS score of 8.2, this vulnerability represents a substantial risk to business continuity and data confidentiality. Unauthorized exploitation could lead to the modification of scheduling data, unauthorized access to user information, or the injection of malicious content into the web portal.

Remediation Plan

Immediate Action: Identify if the Calendar Planner component is installed and immediately apply any patches or security updates released by the vendor.

Proactive Monitoring: Monitor database query logs for unusual activity and review administrative access logs for unauthorized attempts to interact with the Calendar component.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious input and restrict access to sensitive component endpoints until a patch is verified and applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with high priority. Organizations using the Calendar Planner component should assess their exposure and ensure the latest security updates are deployed to prevent potential exploitation.

---METADATA---
VENDOR: Joomla
PRODUCT: SP Movie Database
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The SP Movie Database component for Joomla! contains a security vulnerability that could potentially be leveraged to compromise the integrity of the application.

Executive Summary:
A critical vulnerability in the Joomla! SP Movie Database component presents a high-severity risk to the security and availability of the affected web application.

Vulnerability Details

CVE-ID: CVE-2017-20266

Affected Software: Joomla SP Movie Database

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the SP Movie Database component for Joomla!. The flaw likely stems from improper handling of user-supplied data, which may allow for unauthorized access or other malicious actions within the component's scope.

Business Impact

The high CVSS score of 8.2 underscores the potential for significant impact, including unauthorized access to application databases or potential service disruption. Protecting the integrity of the SP Movie Database is essential to preventing data breach scenarios and maintaining the reliability of the web presence.

Remediation Plan

Immediate Action: Verify the use of the SP Movie Database component and apply the latest security updates or patches provided by the vendor.

Proactive Monitoring: Implement enhanced logging for the component and monitor for suspicious patterns that deviate from normal user interaction with the movie database.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious requests targeting the SP Movie Database component until the necessary updates are fully deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high-severity rating, immediate remediation is required to mitigate the risk of exploitation. We recommend that administrators promptly update the affected component and review system logs to ensure the environment remains secure.

---METADATA---
VENDOR: Joomla
PRODUCT: FocalPoint Pro/Free
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The FocalPoint Pro and Free components for Joomla! contain a security vulnerability that may expose the application to unauthorized access or potential compromise.

Executive Summary:
A high-severity vulnerability in the Joomla! FocalPoint component poses a significant risk to the integrity and security of the hosting application.

Vulnerability Details

CVE-ID: CVE-2017-20263

Affected Software: Joomla FocalPoint Pro/Free

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the FocalPoint component within Joomla! environments. While specific technical details regarding the entry point are limited, such component-level flaws frequently allow for unauthorized data access or execution due to insufficient input validation.

Business Impact

Successful exploitation of this high-severity (CVSS 8.2) vulnerability could result in unauthorized access to sensitive application data or the potential for site-wide compromise. Given the reliance on Joomla! components for content management, an exploit could lead to significant operational downtime and damage to organizational reputation.

Remediation Plan

Immediate Action: Audit your Joomla! installation for the presence of the FocalPoint component and apply all available vendor security updates immediately.

Proactive Monitoring: Review web server access logs for anomalous request patterns or unexpected traffic directed toward component-specific directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common attack vectors targeting Joomla! extensions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this issue necessitates prompt attention from security administrators. We strongly recommend verifying the version of the FocalPoint component currently in use and prioritizing the application of security patches provided by the vendor to eliminate the exposure risk.

---METADATA---
VENDOR: Joomla
PRODUCT: Ajax Quiz
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Joomla! Component Ajax Quiz is susceptible to a security vulnerability that could potentially allow for unauthorized access or system manipulation.

Executive Summary:
The Joomla! Ajax Quiz component is affected by a high-severity vulnerability that poses a risk of unauthorized access and potential compromise of the host environment.

Vulnerability Details

CVE-ID: CVE-2017-20262

Affected Software: Joomla Ajax Quiz

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Ajax Quiz component for Joomla. Given the component's reliance on AJAX functionality, the flaw likely involves insecure server-side processing of asynchronous requests, which could be exploited by an attacker to bypass security controls.

Business Impact

The CVSS score of 8.2 underscores the urgency of addressing this vulnerability to prevent unauthorized access to sensitive application functions. A successful exploit could lead to the exposure of user data, unauthorized administrative actions, or the degradation of service availability, directly impacting business operations.

Remediation Plan

Immediate Action: Identify and disable the Ajax Quiz component within the Joomla administrator panel until a verified security patch is applied.

Proactive Monitoring: Audit application logs for unusual AJAX request patterns or repeated failed authorization attempts originating from the component's path.

Compensating Controls: Implement strict access control lists (ACLs) and use a WAF to inspect and sanitize incoming AJAX requests for potentially malicious payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must act decisively to mitigate this risk by patching or disabling the vulnerable Ajax Quiz component. Consistent with the High severity rating, prompt action is necessary to ensure the ongoing security and stability of the Joomla environment.

---METADATA---
VENDOR: Joomla
PRODUCT: Bargain Product VM3
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Joomla! Component Bargain Product VM3 contains a security vulnerability that requires immediate attention to prevent unauthorized system exploitation.

Executive Summary:
A high-severity security flaw has been identified in the Joomla! Bargain Product VM3 component, necessitating immediate review and remediation to prevent unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2017-20261

Affected Software: Joomla Bargain Product VM3

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the Bargain Product VM3 component for Joomla. While specific technical details are limited, vulnerabilities in such components often involve improper input validation or insecure access controls, which may be exploited by remote, unauthenticated attackers.

Business Impact

The CVSS score of 8.2 reflects the high potential for system compromise, which could result in unauthorized administrative access, site defacement, or the compromise of sensitive customer data stored within the Joomla database. Failure to remediate this vulnerability risks significant reputational damage and potential loss of data integrity.

Remediation Plan

Immediate Action: Disable or uninstall the Bargain Product VM3 component immediately if it is not strictly required for business operations.

Proactive Monitoring: Monitor database query logs for unusual activity or signs of SQL injection attempts, which are common vectors for extension-based vulnerabilities.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious traffic and block requests targeting the specific directory paths associated with this component.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All administrators running the Bargain Product VM3 extension must treat this as a priority. Apply any available patches from the developer immediately; if no patch is provided, the removal of the component is the only effective way to eliminate the risk.

---METADATA---
VENDOR: Joomla
PRODUCT: Price Alert 3
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists within the Joomla! Component Price Alert 3, potentially allowing for unauthorized exploitation of the system.

Executive Summary:
The Joomla! Price Alert 3 component contains a high-severity vulnerability that may expose the underlying application to unauthorized access or manipulation.

Vulnerability Details

CVE-ID: CVE-2017-20260

Affected Software: Joomla Price Alert 3

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Price Alert 3 extension for Joomla. As the specific technical vector is not disclosed, users must assume the potential for unauthenticated remote code execution or unauthorized data access common to vulnerable legacy extensions.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the host Joomla installation. With a CVSS score of 8.2, this flaw is categorized as High severity, indicating that an attacker could potentially gain unauthorized control over the CMS, leading to data exfiltration or complete site compromise.

Remediation Plan

Immediate Action: Audit the installation to identify if the Price Alert 3 component is active and remove or disable it if it is not mission-critical.

Proactive Monitoring: Review web server access logs for anomalous request patterns or unexpected file modification attempts targeting the component directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common web-based attack signatures targeting Joomla extensions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability, administrators should prioritize the removal of outdated or vulnerable extensions. If the component cannot be removed, contact the vendor for a security update or migrate to a supported alternative to minimize the attack surface.

---METADATA---
VENDOR: Joomla
PRODUCT: OSDownloads
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in the Joomla OSDownloads extension. The specific technical details of the flaw are currently limited.

Executive Summary:
The Joomla OSDownloads extension contains an unpatched vulnerability that poses a high security risk to affected website installations.

Vulnerability Details

CVE-ID: CVE-2017-20259

Affected Software: Joomla OSDownloads

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an unspecified security flaw within the OSDownloads extension for Joomla. Due to the lack of granular technical documentation, the authentication requirements remain indeterminate; however, extensions of this type often permit unauthenticated remote interactions.

Business Impact

A successful exploit of this vulnerability could lead to unauthorized access to sensitive site data or potential site compromise. With a CVSS score of 8.2, this flaw is classified as High severity and could result in significant operational disruption or data leakage if left unmitigated.

Remediation Plan

Immediate Action: Audit your Joomla installation for the presence of the OSDownloads extension and disable or remove the component if it is not strictly necessary for business operations.

Proactive Monitoring: Review web server access logs for anomalous request patterns or unexpected file access attempts originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter potentially malicious incoming traffic targeting your Joomla environment.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity score and the potential for unauthorized access, administrators should prioritize the removal or containment of the OSDownloads extension. Verify the status of your Joomla extensions immediately and apply any available vendor patches to ensure the integrity of the application environment.

---METADATA---
VENDOR: Joomla
PRODUCT: RPC Responsive Portfolio component
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The RPC Responsive Portfolio component for Joomla contains a high-severity vulnerability that may lead to unauthorized system access or data compromise.

Executive Summary:
The Joomla RPC Responsive Portfolio component is susceptible to a high-severity vulnerability that poses a significant risk of unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2017-20258

Affected Software: Joomla RPC Responsive Portfolio

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the RPC Responsive Portfolio component for Joomla, potentially exposing the system to unauthorized actions. The lack of detailed technical documentation suggests that the flaw may reside in the component's handling of user-supplied data or lack of proper privilege validation.

Business Impact

The CVSS score of 8.2 confirms this is a High-severity risk that could result in substantial business impact. Compromise of this component could facilitate unauthorized data extraction or site manipulation, leading to operational downtime and potential loss of proprietary or user-sensitive data stored within the portfolio.

Remediation Plan

Immediate Action: Immediately assess the environment for the presence of the RPC Responsive Portfolio component and disable it until a secure version is confirmed.

Proactive Monitoring: Regularly review application logs for unexpected behavior and monitor for unauthorized administrative modifications within the Joomla backend.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic and block requests that match known malicious patterns often associated with Joomla extension vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations must act immediately to mitigate this High-severity risk. We strongly recommend removing the vulnerable extension from all production servers and implementing strict monitoring to ensure no unauthorized access has already occurred.

---METADATA---
VENDOR: Joomla
PRODUCT: Quiz Deluxe component
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Quiz Deluxe component for Joomla contains a high-severity vulnerability that may lead to unauthorized system access or data exposure.

Executive Summary:
The Joomla Quiz Deluxe component is susceptible to a high-severity vulnerability that poses a significant risk of unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2017-20257

Affected Software: Joomla Quiz Deluxe

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the Quiz Deluxe component for Joomla, which may allow an attacker to bypass security controls. The exact entry point is not publicly detailed, but such flaws typically involve insufficient input validation or improper authorization checks within the extension.

Business Impact

With a CVSS score of 8.2, this vulnerability represents a High-severity risk to the organization. Successful exploitation could allow unauthorized actors to manipulate quiz data, access sensitive user information, or potentially gain further control over the Joomla instance, leading to severe reputational and security consequences.

Remediation Plan

Immediate Action: Identify and disable the Quiz Deluxe component immediately until a vendor-supplied update is verified and installed.

Proactive Monitoring: Monitor database query logs for unusual activity related to the component's tables and inspect administrative access logs for unauthorized attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block suspicious input patterns or unauthorized access attempts targeting Joomla extensions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates a swift response to minimize exposure. Security teams should treat this as a priority update and ensure that the vulnerable component is isolated or removed from production environments until official patches are applied.

---METADATA---
VENDOR: Joomla
PRODUCT: Survey Force Deluxe
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability in the Joomla Survey Force Deluxe extension may allow unauthenticated attackers to compromise the web application.

Executive Summary:
A critical security flaw in the Joomla Survey Force Deluxe extension poses a significant risk of unauthorized access and potential data compromise for affected web platforms.

Vulnerability Details

CVE-ID: CVE-2017-20256

Affected Software: Joomla Survey Force Deluxe

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the Survey Force Deluxe extension for Joomla. It allows an unauthenticated attacker to exploit weaknesses in the extension's code, potentially leading to unauthorized data access or system manipulation.

Business Impact

Successful exploitation could result in the compromise of user-submitted survey data, which may contain personally identifiable information (PII). A CVSS score of 8.2 underscores the high risk to data privacy and regulatory compliance, necessitating immediate remediation to prevent potential data breaches.

Remediation Plan

Immediate Action: Immediately update the Survey Force Deluxe extension to the latest secure version or disable the component if no patch is available.

Proactive Monitoring: Review database logs for anomalous queries and check for unauthorized changes to survey configurations or user data.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to block common exploit patterns associated with Joomla extension vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations relying on the Survey Force Deluxe extension for data collection must treat this vulnerability with high urgency. Patching or removing the vulnerable code is essential to protect against potential exploitation of sensitive user information.

---METADATA---
VENDOR: Joomla
PRODUCT: JB Visa component
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The JB Visa component for Joomla contains a high-severity vulnerability that may allow for unauthorized system interaction.

Executive Summary:
The Joomla JB Visa component is susceptible to a high-severity vulnerability that poses a significant risk of unauthorized access or system compromise.

Vulnerability Details

CVE-ID: CVE-2017-20255

Affected Software: Joomla JB Visa

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the JB Visa component for Joomla, potentially allowing an attacker to exploit flaws within the extension. Due to the lack of specific technical disclosure, the authentication requirement remains indeterminate; however, component-level flaws of this nature often allow for remote exploitation.

Business Impact

The vulnerability carries a CVSS score of 8.2, classifying it as a High-severity risk. A successful exploit could lead to unauthorized data access, potential site defacement, or the compromise of administrative functions within the Joomla environment, causing significant operational disruption and loss of data integrity.

Remediation Plan

Immediate Action: Audit the Joomla installation for the presence of the JB Visa component and remove it if it is not business-critical or if a patch is unavailable.

Proactive Monitoring: Review web server and Joomla application logs for anomalous requests directed at component-specific paths or unusual POST requests.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter traffic attempting to interact with the vulnerable component's URI patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High-severity CVSS score and the potential for unauthenticated or elevated access, organizations utilizing the JB Visa component must prioritize this issue. We recommend immediate removal of the vulnerable component until the vendor provides a verified security patch.

---METADATA---
VENDOR: Joomla
PRODUCT: User Bench Component
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Joomla User Bench 1 component, which may allow for unauthorized actions or security bypasses within the affected Joomla environment.

Executive Summary:
The Joomla User Bench 1 component is affected by a high-severity vulnerability that could facilitate unauthorized access or manipulation of user-related data.

Vulnerability Details

CVE-ID: CVE-2017-20254

Affected Software: Joomla User Bench Component

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the User Bench 1 component for Joomla. Similar to other component-level flaws, it likely stems from inadequate security controls, potentially allowing an attacker to perform unauthorized actions or manipulate data managed by the component.

Business Impact

An exploit could compromise the confidentiality and integrity of user information managed by the User Bench component. With a CVSS score of 8.2, this vulnerability presents a high risk, as it could be leveraged to escalate privileges or exfiltrate sensitive user data, leading to significant reputational and security risks.

Remediation Plan

Immediate Action: Update the User Bench component to the latest available version or disable the component if it is not essential to the system's functionality.

Proactive Monitoring: Monitor system logs for anomalous activity related to user management or unauthorized attempts to access component-specific endpoints.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious requests targeting known Joomla component vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately assess their Joomla environments for the presence of the User Bench component. Given the high-severity rating, it is imperative to apply updates or remove the vulnerable software to prevent potential exploitation.

---METADATA---
VENDOR: Joomla
PRODUCT: My Projects Component
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability exists in the Joomla My Projects 2 component, which may allow for unauthorized actions or information disclosure within the affected Joomla environment.

Executive Summary:
The Joomla My Projects 2 component contains a high-severity vulnerability that could lead to unauthorized access or data compromise within the application framework.

Vulnerability Details

CVE-ID: CVE-2017-20253

Affected Software: Joomla My Projects Component

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability resides within the My Projects 2 component for Joomla. While specific technical details are limited, such component flaws often involve improper input validation or insufficient access control checks, potentially allowing an attacker to bypass intended security restrictions.

Business Impact

Successful exploitation could lead to unauthorized access to sensitive project data managed by the component, resulting in potential data theft or integrity loss. The CVSS score of 8.2 reflects the high risk to data confidentiality and integrity, necessitating prompt attention to prevent unauthorized administrative or user-level actions.

Remediation Plan

Immediate Action: Update the My Projects component to the latest available version or remove the component if it is no longer required for business operations.

Proactive Monitoring: Review application logs for suspicious access patterns or unauthorized attempts to access component-specific URLs and functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common exploit patterns against Joomla components.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should audit their Joomla installations to identify the presence of the My Projects component. If found, prioritize updating the component to a secure version to mitigate the risk of unauthorized access and potential data compromise.

---METADATA---
VENDOR: Joomla
PRODUCT: NextGen Editor
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in the Joomla NextGen Editor extension allows for unauthorized access or potential compromise of the CMS environment.

Executive Summary:
The Joomla NextGen Editor extension contains a high-severity vulnerability that may allow unauthenticated attackers to compromise the integrity of the Joomla content management system.

Vulnerability Details

CVE-ID: CVE-2017-20252

Affected Software: Joomla NextGen Editor

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from flaws within the NextGen Editor extension for Joomla. While specific technical details are limited, such vulnerabilities in CMS extensions typically allow unauthenticated attackers to execute unauthorized actions or access restricted data.

Business Impact

The exploitation of this vulnerability could lead to unauthorized administrative access, defacement, or the exfiltration of sensitive site data. With a CVSS score of 8.2, the impact on business operations is significant, as it threatens the availability and security of the organization's web presence.

Remediation Plan

Immediate Action: Update the NextGen Editor extension to the latest patched version provided by the vendor or remove the plugin if a fix is not available.

Proactive Monitoring: Monitor CMS audit logs for unauthorized file modifications or suspicious administrative account activity.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious requests targeting known Joomla extension vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CMS extensions are frequent targets for automated exploitation attempts. Administrators must ensure that all third-party plugins are kept up to date and that unnecessary extensions are disabled to reduce the overall attack surface.

---METADATA---
VENDOR: WordPress
PRODUCT: Insert PHP
AFFECTED_VERSIONS: WordPress Insert PHP plugin versions before 3.3.1
---END_METADATA---

Description Summary:
The WordPress Insert PHP plugin contains a PHP code injection vulnerability allowing unauthenticated remote code execution via the REST API.

Executive Summary:
A critical code injection vulnerability in the WordPress Insert PHP plugin allows unauthenticated attackers to achieve remote code execution, posing a severe risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2017-20251

Affected Software: WordPress Insert PHP

Affected Versions: WordPress Insert PHP plugin versions before 3.3.1

Vulnerability: This is a PHP code injection vulnerability where unauthenticated attackers can inject malicious shortcodes via the wp-json/wp/v2/posts REST API endpoint. The vulnerability facilitates the inclusion and execution of arbitrary remote PHP files on the underlying server.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical threat to business operations. Successful exploitation grants an attacker full control over the web server, leading to potential data exfiltration, total site compromise, and the deployment of persistent backdoors within the hosting environment.

Remediation Plan

Immediate Action: Update the WordPress Insert PHP plugin to version 3.3.1 or higher immediately to apply the vendor-supplied patch.

Proactive Monitoring: Audit WordPress access logs for suspicious POST requests targeting the wp-json/wp/v2/posts endpoint and monitor server file integrity for unexpected PHP file creation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious REST API payloads and inspect incoming shortcode parameters for malicious PHP syntax.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jun 9, 2026, there is confirmed public exploit availability for this vulnerability. Given the ease of exploitation through the REST API, organizations must prioritize patching to prevent unauthorized remote code execution.

Analyst Recommendation

Given the critical CVSS severity and the availability of public exploits, this vulnerability poses an immediate danger to WordPress environments. Administrators should audit their plugin inventory and apply the 3.3.1 update without delay to mitigate the risk of full system compromise.

---METADATA---
VENDOR: Hirschmann
PRODUCT: Industrial HiVision
AFFECTED_VERSIONS: Prior to 06.0.07 and 07.0.03
---END_METADATA---

Description Summary:
An authentication bypass in Hirschmann Industrial HiVision's master service allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges.

Executive Summary:
Hirschmann Industrial HiVision software contains a critical authentication bypass in its master service, allowing unauthenticated remote code execution with full administrative rights.

Vulnerability Details

CVE-ID: CVE-2017-20237

Affected Software: Hirschmann Industrial HiVision

Affected Versions: Prior to 06.0.07 and 07.0.03

Vulnerability: Exposed interface methods in the master service fail to enforce authentication. An unauthenticated remote attacker can invoke these methods to execute commands on the underlying operating system.

Business Impact

This vulnerability allows for complete control over the network management station, potentially leading to the compromise of the entire industrial control system (ICS) environment. The CVSS score of 9.8 reflects the extreme risk to operational technology (OT) environments.

Remediation Plan

Immediate Action: Upgrade Hirschmann Industrial HiVision to version 06.0.07, 07.0.03, or higher immediately to close the exposed service interfaces.

Proactive Monitoring: Inspect network traffic for unauthorized calls to the master service and monitor the host operating system for unexpected process execution.

Compensating Controls: Isolate the Industrial HiVision server within a secure management VLAN and restrict access via a firewall to only authorized administrative hosts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation. However, as a late disclosure of a critical RCE in an industrial product, it should be treated with the highest urgency.

Analyst Recommendation

Unauthenticated remote code execution on a network management platform is a "crown jewel" vulnerability for attackers. Immediate patching is mandatory to prevent catastrophic unauthorized access to critical industrial infrastructure.

---METADATA---
VENDOR: ProSoft Technology
PRODUCT: ICX35-HWC
AFFECTED_VERSIONS: Versions 1.3 and prior
---END_METADATA---

Description Summary:
An input validation vulnerability in the ProSoft ICX35-HWC web interface allows remote attackers to inject and execute system commands with root privileges.

Executive Summary:
ProSoft Technology ICX35-HWC gateways are vulnerable to a critical command injection flaw that permits remote attackers to execute arbitrary system commands with root-level privileges.

Vulnerability Details

CVE-ID: CVE-2017-20236

Affected Software: ProSoft Technology ICX35-HWC

Affected Versions: Versions 1.3 and prior

Vulnerability: The web interface fails to properly validate input in certain fields, allowing attackers to inject malicious shell commands. These commands are executed by the system with root-level authority.

Business Impact

Total compromise of the gateway device is possible, allowing attackers to install persistent backdoors, sniff traffic, or disrupt critical industrial operations. The CVSS score of 9.8 indicates a maximum-severity risk due to the ease of exploitation and high level of access granted.

Remediation Plan

Immediate Action: Upgrade the ICX35-HWC firmware to the latest secure version immediately to eliminate command injection vectors.

Proactive Monitoring: Use network intrusion detection systems (IDS) to scan for shell-related keywords (e.g., /bin/sh, sudo, cat /etc/passwd) in HTTP traffic directed at the device.

Compensating Controls: Restrict access to the web interface to a trusted management network and implement strict egress filtering to prevent the device from communicating with attacker-controlled servers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation. However, command injection leading to root access is a highly sought-after capability for threat actors targeting industrial hardware.

Analyst Recommendation

Root-level command injection is one of the most dangerous vulnerabilities possible for a network device. Immediate firmware replacement or upgrading is the only effective way to mitigate this critical risk.

---METADATA---
VENDOR: ProSoft Technology
PRODUCT: ICX35-HWC
AFFECTED_VERSIONS: Version 1.3 and prior
---END_METADATA---

Description Summary:
An authentication bypass in the ProSoft ICX35-HWC cellular gateway web interface allows unauthenticated attackers to gain full administrative access to the device.

Executive Summary:
ProSoft Technology ICX35-HWC cellular gateways contain a critical authentication bypass vulnerability that grants unauthenticated remote attackers complete administrative control over the device.

Vulnerability Details

CVE-ID: CVE-2017-20235

Affected Software: ProSoft Technology ICX35-HWC

Affected Versions: Version 1.3 and prior

Vulnerability: A flaw in the firmware's web user interface allows attackers to circumvent the authentication mechanism entirely, providing unauthenticated access to all administrative settings and configuration functions.

Business Impact

An attacker with administrative access can redirect network traffic, disable communications, or use the gateway as a pivot point into the internal industrial network. The CVSS score of 9.1 highlights the severe risk to critical infrastructure connectivity.

Remediation Plan

Immediate Action: Update the ICX35-HWC firmware to a version newer than 1.3 immediately to resolve the authentication flaw.

Proactive Monitoring: Monitor for unauthorized configuration changes and review device logs for administrative logins from unexpected external IP addresses.

Compensating Controls: Disable the web management interface on the cellular (WAN) side and require a secure VPN connection for any remote administrative access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation. This is a late-disclosed vulnerability affecting legacy industrial hardware, which often remains unpatched in the field.

Analyst Recommendation

Administrative access bypasses on gateway devices are high-impact events. It is critical to update the firmware on all ProSoft ICX35-HWC units to prevent unauthorized actors from seizing control of remote communication links.

---METADATA---
VENDOR: GarrettCom
PRODUCT: Magnum 6K and 10K managed switches
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
GarrettCom Magnum 6K and 10K switches contain an authentication bypass via a hardcoded string. Unauthenticated attackers can gain full administrative access to switch configurations.

Executive Summary:
GarrettCom managed switches are subject to a critical authentication bypass vulnerability due to a hardcoded string, granting unauthenticated attackers full administrative control.

Vulnerability Details

CVE-ID: CVE-2017-20234

Affected Software: GarrettCom Magnum 6K and 10K managed switches

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from a hardcoded string within the authentication mechanism of the switch firmware. An unauthenticated attacker can exploit this string to bypass login controls and access administrative functions and sensitive configuration data.

Business Impact

A successful exploit allows an attacker to take complete control of the network infrastructure provided by these switches. This can lead to traffic interception, network outages, and unauthorized configuration changes. The CVSS score of 9.8 reflects the catastrophic risk to network integrity and availability.

Remediation Plan

Immediate Action: Update the switch firmware to the latest version provided by GarrettCom to remove the hardcoded authentication bypass.

Proactive Monitoring: Monitor management interface logs for successful logins from unusual IP addresses and audit configuration changes regularly.

Compensating Controls: Restrict access to the management interfaces of these switches to a dedicated, isolated management VLAN with strict ACLs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation of this vulnerability. This is a late disclosure of a legacy issue, but the technical risk remains critical for unpatched hardware.

Analyst Recommendation

Hardcoded credentials in networking hardware represent a severe security failure that allows effortless compromise of the network backbone. Administrators must identify all GarrettCom Magnum switches in their environment and apply firmware updates immediately. If patching is not possible, the management interface must be completely firewalled from the rest of the network.

---METADATA---
VENDOR: Perl
PRODUCT: Storable
AFFECTED_VERSIONS: Before 3.05
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Storable module for Perl contains a stack overflow vulnerability in the retrieve_hook function due to inconsistent handling of class name length between signed and unsigned integers.

Executive Summary:
A critical stack overflow vulnerability in the Perl Storable module before version 3.05 could allow attackers to execute arbitrary code via malformed data.

Vulnerability Details

CVE-ID: CVE-2017-20230

Affected Software: Perl Storable

Affected Versions: Before 3.05

Vulnerability: The vulnerability exists in the retrieve_hook function, which incorrectly handles class name lengths by mixing signed and unsigned integer operations, triggering a stack overflow during read operations.

Business Impact

A stack overflow in a core Perl module can result in application crashes, denial of service, or potentially remote code execution. With a CVSS score of 10.0, this represents an extremely high risk, as it may allow an attacker to gain control over the underlying host system, leading to full compromise of the application environment.

Remediation Plan

Immediate Action: Upgrade the Storable module to version 3.05 or higher to resolve the integer handling inconsistency.

Proactive Monitoring: Monitor application logs for unexpected termination or segmentation faults that may indicate memory corruption attempts.

Compensating Controls: Utilize memory protection features provided by the operating system (e.g., ASLR, DEP/NX) to hinder successful exploitation of stack-based overflows.

Exploitation Status

Public Exploit Available: None

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability carries a maximum severity rating and requires immediate attention for any systems utilizing the Perl Storable module. Ensure that dependencies are updated to the patched version as soon as possible to prevent potential remote exploitation.

---METADATA---
VENDOR: MAWK
PRODUCT: MAWK (AWK Interpreter)
AFFECTED_VERSIONS: 1.3.3-17 and prior
---END_METADATA---

Description Summary:
MAWK 1.3.3-17 and prior contains a stack-based buffer overflow vulnerability that allows arbitrary code execution via crafted, malicious input.

Executive Summary:
A critical stack-based buffer overflow in the MAWK interpreter allows attackers to achieve arbitrary code execution by exploiting inadequate boundary checks on user-supplied input.

Vulnerability Details

CVE-ID: CVE-2017-20229

Affected Software: MAWK

Affected Versions: 1.3.3-17 and prior

Vulnerability: The MAWK utility fails to validate the length of input data, leading to a stack buffer overflow. An attacker can provide unauthenticated malicious input that overflows the buffer, allowing for the execution of a ROP chain to spawn a shell with the application's privileges.

Business Impact

Since AWK interpreters are frequently used in automated scripts and system processing, an exploit could allow an attacker to gain control over critical system tasks. The CVSS score of 9.8 indicates a critical risk to system integrity and the potential for full administrative compromise.

Remediation Plan

Immediate Action: Update MAWK to the latest version provided by your operating system's package manager (e.g., apt-get install mawk).

Proactive Monitoring: Audit shell scripts that utilize MAWK to ensure they are not processing untrusted, unsanitized data from external sources.

Compensating Controls: Implement restrictive SELinux or AppArmor profiles for the MAWK binary to limit the actions it can perform on the system.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ubiquity of AWK interpreters in Linux environments makes this a significant latent risk.

Analyst Recommendation

The MAWK interpreter is a core utility in many Linux distributions. Administrators must ensure that all systems are updated to a version that includes boundary check fixes to prevent attackers from leveraging scripts as an execution vector.

---METADATA---
VENDOR: JAD
PRODUCT: Java Decompiler
AFFECTED_VERSIONS: 1.5.8e-1kali1 and prior
---END_METADATA---

Description Summary:
JAD Java Decompiler 1.5.8e-1kali1 and prior contains a stack-based buffer overflow allowing arbitrary code execution via overly long input strings passed to the jad command.

Executive Summary:
A critical stack-based buffer overflow in the JAD Java Decompiler allows local attackers to execute arbitrary code by supplying maliciously crafted input that exceeds buffer boundaries.

Vulnerability Details

CVE-ID: CVE-2017-20227

Affected Software: JAD Java Decompiler

Affected Versions: 1.5.8e-1kali1 and prior

Vulnerability: This is a stack-based buffer overflow occurring within the jad command-line utility. An attacker can provide an unauthenticated, overly long input string that overflows the stack, allowing for the execution of a return-oriented programming (ROP) chain to spawn a shell.

Business Impact

A successful exploit allows an attacker to gain the same privileges as the user running the JAD utility. In environments where developers or automated systems process untrusted Java files, this could lead to full workstation compromise or lateral movement within the build pipeline. The CVSS score of 9.8 reflects the critical nature of arbitrary code execution, despite the requirement for local interaction.

Remediation Plan

Immediate Action: Update the JAD Java Decompiler to the latest available version or migrate to a maintained alternative, as this version is officially deprecated in many distributions.

Proactive Monitoring: Monitor system logs for unusual shell activity originating from the jad process and implement execution prevention on untrusted binaries.

Compensating Controls: Utilize sandboxing or containerization when running decompilation tasks on untrusted files to isolate the impact of potential exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 28, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw allows for reliable code execution via ROP chains, the potential for exploitation remains high for users of legacy tools.

Analyst Recommendation

The severity of a stack-based buffer overflow in a development tool cannot be overstated, as it targets the integrity of the software supply chain. Organizations should immediately identify systems running legacy versions of JAD and apply updates or replace the software with modern, secure decompilers.

---METADATA---
VENDOR: TiEmu
PRODUCT: TiEmu (TI Emulator)
AFFECTED_VERSIONS: 2.08 and prior
---END_METADATA---

Description Summary:
TiEmu 2.08 and prior is vulnerable to a stack-based buffer overflow via command-line arguments, allowing for arbitrary code execution using ROP gadgets.

Executive Summary:
TiEmu 2.08 and prior contains a critical stack-based buffer overflow that allows attackers to execute arbitrary code by exploiting inadequate boundary checks on command-line input.

Vulnerability Details

CVE-ID: CVE-2017-20225

Affected Software: TiEmu

Affected Versions: 2.08 and prior

Vulnerability: The vulnerability exists due to improper handling of user-supplied command-line arguments. An attacker can trigger an unauthenticated overflow by passing malicious arguments, leveraging ROP gadgets to bypass system protections and execute arbitrary shellcode.

Business Impact

Successful exploitation results in the execution of arbitrary commands with the privileges of the user running the emulator. This could lead to data theft or further exploitation of the local network. The CVSS score of 9.8 reflects the high impact of the code execution flaw.

Remediation Plan

Immediate Action: Update TiEmu to a version later than 2.08 or apply vendor-provided patches immediately.

Proactive Monitoring: Monitor for anomalous command-line arguments passed to emulator processes and review system logs for unauthorized shell spawns.

Compensating Controls: Restrict the execution of TiEmu to non-privileged user accounts and utilize AppLocker or similar tools to control application behavior.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 28, 2026, there is no public information indicating active exploitation of this vulnerability. The reliance on ROP gadgets suggests a sophisticated exploit could be developed quickly by motivated actors.

Analyst Recommendation

Users of TiEmu should immediately verify their version and update to a patched release. In environments where this software is used for academic or engineering purposes, strict application control policies should be enforced to mitigate the risk of local exploitation.

---METADATA---
VENDOR: Telesquare
PRODUCT: SKT LTE Router SDT-CS3B1
AFFECTED_VERSIONS: 1.2.0
---END_METADATA---

Description Summary:
An unauthenticated arbitrary file upload vulnerability in the Telesquare SDT-CS3B1 router allows attackers to execute remote code or delete files by exploiting enabled WebDAV HTTP methods.

Executive Summary:
The Telesquare SKT LTE Router contains a critical vulnerability allowing unauthenticated attackers to upload and execute malicious code, potentially leading to full device takeover.

Vulnerability Details

CVE-ID: CVE-2017-20224

Affected Software: Telesquare SKT LTE Router SDT-CS3B1

Affected Versions: 1.2.0

Vulnerability: The device improperly handles WebDAV HTTP methods (PUT, MOVE, PROPPATCH), allowing an unauthenticated attacker to upload arbitrary files to the server. This enables the execution of malicious scripts or the deletion of critical system files.

Business Impact

The impact is severe, as it grants attackers the ability to achieve Remote Code Execution (RCE) on the router. This can lead to persistent network eavesdropping, denial of service, or using the compromised router as a pivot point to attack the internal network. The CVSS score of 9.8 underscores the maximum risk associated with unauthenticated remote access.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by Telesquare to disable unauthorized WebDAV methods or patch the file upload logic.

Proactive Monitoring: Monitor network traffic for unusual HTTP methods like PUT or MOVE directed at the router's management interface and review logs for unauthorized file creations.

Compensating Controls: Disable the WebDAV service if it is not required for business operations and restrict access to the router's web interface using a firewall or VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of unauthenticated file uploads on networking hardware, the risk of exploitation is significant.

Analyst Recommendation

This vulnerability represents a high-priority risk to network infrastructure. Administrators should immediately update the router firmware to a secure version. If an update is unavailable, the management interface must be isolated from the public internet and WebDAV functionality should be disabled to prevent remote compromise.

---METADATA---
VENDOR: Telesquare
PRODUCT: SKT LTE Router SDT-CS3B1
AFFECTED_VERSIONS: 1.2.0
---END_METADATA---

Description Summary:
An Insecure Direct Object Reference (IDOR) vulnerability in Telesquare SDT-CS3B1 routers allows attackers to bypass authorization and access sensitive resources by manipulating input parameters.

Executive Summary:
Telesquare routers are vulnerable to a critical authorization bypass that allows attackers to access sensitive system information and administrative functions without proper credentials.

Vulnerability Details

CVE-ID: CVE-2017-20223

Affected Software: Telesquare SKT LTE Router SDT-CS3B1

Affected Versions: 1.2.0

Vulnerability: The firmware contains an IDOR flaw where user-supplied input parameters are used to reference internal objects directly. An attacker can manipulate these parameters to bypass security checks and access resources they are not authorized to view.

Business Impact

A successful exploit allows for the unauthorized retrieval of sensitive configuration data, user credentials, or administrative control of the device. Given the CVSS score of 9.8, this vulnerability represents a near-total breakdown of the device's access control logic, potentially exposing the entire network segment managed by the router.

Remediation Plan

Immediate Action: Update the Telesquare SDT-CS3B1 firmware to the latest version to implement proper server-side authorization checks for all object references.

Proactive Monitoring: Audit web server logs for sequential or anomalous parameter changes in HTTP requests that might indicate an IDOR discovery attempt.

Compensating Controls: Implement an IP-based access control list (ACL) to restrict access to the router's management interface to known, trusted administrative workstations only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 16, 2026, there is no public information indicating active exploitation. This is a late-disclosure vulnerability, meaning the flaw has existed for some time, increasing the likelihood that sophisticated actors may already be aware of it.

Analyst Recommendation

This critical IDOR vulnerability must be addressed immediately by updating the device firmware. Insecure Direct Object Reference flaws are often easy to exploit with automated tools; therefore, isolating the device management interface from the internet is a vital secondary defense.

Executive Summary:
A critical remote command injection vulnerability exists in multiple FLIR Thermal Camera products. This flaw allows an unauthenticated attacker on the network to execute arbitrary commands with the highest privileges (root), enabling them to take complete control of the affected camera, access sensitive video feeds, and potentially pivot to attack other systems on the internal network.

Vulnerability Details

CVE-ID: CVE-2017-20216

Affected Software: FLIR Thermal Camera Multiple Products

Affected Versions: Firmware version 8.0.0.64 is confirmed vulnerable. See vendor advisory for a complete list of affected products and versions.

Vulnerability: The vulnerability lies within the controllerFlirSystem.php script accessible on the device's web interface. The execFlirSystem() function within this script fails to properly sanitize user-supplied input sent via POST requests. An unauthenticated remote attacker can craft a malicious POST request containing arbitrary system commands, which are then passed directly to a shell_exec() call and executed on the underlying operating system with root privileges.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Successful exploitation grants an attacker complete control over the affected thermal camera. This could lead to a severe breach of physical security by disabling surveillance, manipulation of video feeds, or exfiltration of sensitive thermal imaging data. Furthermore, the compromised device can be used as a staging point for lateral movement, allowing attackers to pivot and launch further attacks against the internal corporate network, posing a significant risk of a wider data breach or operational disruption.

Remediation Plan

Immediate Action: Immediately apply the latest firmware updates provided by FLIR to all affected thermal camera products to patch the vulnerability. Concurrently, review system and network access logs for any signs of compromise, paying close attention to requests targeting the controllerFlirSystem.php script.

Proactive Monitoring: Monitor network traffic for suspicious POST requests to the /cgi-bin/controllerFlirSystem.php endpoint on FLIR devices. System administrators should also watch for unusual outbound network connections from the cameras, unexpected running processes, or modifications to system files that could indicate a successful compromise.

Compensating Controls: If immediate patching is not feasible, implement network segmentation to isolate the thermal cameras from critical internal networks. Use a firewall or network access control lists (ACLs) to restrict access to the camera's web management interface to only trusted administrative workstations.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of January 6, 2026, the Shadowserver Foundation has observed active, in-the-wild exploitation of this vulnerability. The ease of exploitation (a single unauthenticated web request) combined with active scanning and attacks means that any internet-exposed, unpatched device is at extremely high risk of compromise.

Analyst Recommendation

Given the critical CVSS score of 9.8 and confirmed evidence of active exploitation in the wild, this vulnerability requires immediate attention. Organizations must prioritize applying the vendor-supplied firmware updates to all affected FLIR cameras without delay. Although this CVE is not currently on the CISA KEV list, its active exploitation status warrants treating it with the same level of urgency as a KEV-listed vulnerability. Implementing compensating controls, such as network segmentation for all IoT/OT devices, should be considered a standard security practice to mitigate the risk of similar vulnerabilities in the future.

---METADATA---
VENDOR: Moxa
PRODUCT: NPort
AFFECTED_VERSIONS: Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior.
---END_METADATA---

Description Summary:
Moxa NPort devices are vulnerable to an information exposure flaw caused by improper handling of Ethernet frame padding, potentially allowing unauthorized access to sensitive data.

Executive Summary:
A critical information exposure vulnerability in Moxa NPort serial device servers may allow unauthorized parties to access sensitive data due to flawed Ethernet frame padding handling.

Vulnerability Details

CVE-ID: CVE-2017-16715

Affected Software: Moxa NPort

Affected Versions: Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior.

Vulnerability: This vulnerability involves an information exposure flaw within the device's handling of Ethernet frame padding. An attacker on the local network could potentially leverage this flaw to intercept or view data that should remain protected.

Business Impact

The CVSS score of 8.6 indicates a high-severity risk, primarily regarding the confidentiality and integrity of industrial communication traffic. Unauthorized exposure of this data can lead to the compromise of proprietary operational configurations or sensitive process information, potentially resulting in significant operational downtime or loss of intellectual property.

Remediation Plan

Immediate Action: Update all affected NPort devices to the latest firmware versions provided by Moxa at the official support portal.

Proactive Monitoring: Monitor network traffic for unusual Ethernet frames or unexpected communication patterns originating from serial device servers.

Compensating Controls: Implement network segmentation to isolate industrial devices from untrusted network segments and restrict access to these devices via firewalls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score of 8.6, organizations utilizing Moxa NPort devices must prioritize firmware updates. Failure to remediate could allow attackers to gain unauthorized visibility into industrial networks; therefore, patching should be scheduled immediately to mitigate the risk of information leakage.

---METADATA---
VENDOR: Orpak
PRODUCT: SiteOmat OrCU
AFFECTED_VERSIONS: Orpak SiteOmat versions prior to 6.4.414.122.
---END_METADATA---

Description Summary:
The Orpak SiteOmat OrCU component contains a code injection vulnerability caused by a search query utilizing a direct shell command, enabling remote code execution.

Executive Summary:
A critical code injection vulnerability in the Orpak SiteOmat OrCU component allows unauthenticated attackers to execute arbitrary shell commands, risking full system compromise.

Vulnerability Details

CVE-ID: CVE-2017-14853

Affected Software: Orpak SiteOmat

Affected Versions: Orpak SiteOmat versions prior to 6.4.414.122.

Vulnerability: The vulnerability exists in the OrCU component, which fails to sanitize input in a search query that triggers a direct shell command. By injecting malicious parameters into the request, an attacker can execute arbitrary commands on the underlying operating system.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a severe threat, allowing for unauthorized access to view and edit payment information, system configurations, and monitoring data. Successful exploitation could lead to full remote code execution, enabling attackers to disrupt critical business operations or exfiltrate sensitive financial records.

Remediation Plan

Immediate Action: Upgrade the Orpak SiteOmat software to version 6.4.414.122 or later immediately to patch the command injection vector.

Proactive Monitoring: Review system logs for suspicious shell commands or unauthorized requests targeting the OrCU component.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block malicious input strings containing shell metacharacters before they reach the application.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 4, 2026, there is evidence of active exploitation in the wild, which significantly elevates the urgency of this advisory.

Analyst Recommendation

This vulnerability is critical due to the confirmed existence of public exploit code and active exploitation observed in the field. Administrators should treat this as a high-priority incident and apply the recommended version update without delay to prevent unauthorized remote code execution.

---METADATA---
VENDOR: Orpak
PRODUCT: SiteOmat management console
AFFECTED_VERSIONS: All known versions
---END_METADATA---

Description Summary:
The Orpak SiteOmat management console is vulnerable to insecure communication due to the use of an invalid SSL certificate across all known software versions.

Executive Summary:
All versions of the Orpak SiteOmat management console are susceptible to man-in-the-middle attacks resulting from invalid SSL certificate implementations.

Vulnerability Details

CVE-ID: CVE-2017-14852

Affected Software: Orpak SiteOmat management console

Affected Versions: All known versions

Vulnerability: The vulnerability stems from an insecure communication channel between the user and the management console. By utilizing an invalid SSL certificate, the system fails to verify the identity of the server, allowing an attacker to intercept or manipulate sensitive traffic.

Business Impact

With a CVSS score of 8.6, this vulnerability creates a high risk of credential theft and unauthorized administrative access. Successful exploitation could lead to full compromise of the management console, potentially impacting the operational integrity of the systems it governs.

Remediation Plan

Immediate Action: Consult the vendor for available security updates or configuration guidance to replace invalid certificates with trusted, valid ones.

Proactive Monitoring: Monitor network traffic to the SiteOmat console for anomalous SSL certificate warnings or evidence of interception attempts.

Compensating Controls: Restrict access to the management console to authorized internal networks only, utilizing VPNs or firewalls to minimize exposure to external threats.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The reliance on invalid certificates undermines the fundamental security of the management console. Organizations should treat this as a high-priority configuration issue and seek updated documentation or patches from the vendor to remediate the certificate trust chain.

---METADATA---
VENDOR: Moxa
PRODUCT: NPort
AFFECTED_VERSIONS: Moxa NPort 5110 versions prior to 2.9
---END_METADATA---

Description Summary:
A stack-based buffer overflow in Moxa NPort 5110 allows remote attackers to execute arbitrary code or cause a denial-of-service.

Executive Summary:
Moxa NPort 5110 serial device servers are affected by a stack-based buffer overflow that could permit remote code execution or system crashes.

Vulnerability Details

CVE-ID: CVE-2016-9365

Affected Software: Moxa NPort 5110

Affected Versions: Moxa NPort 5110 versions prior to 2.9.

Vulnerability: This is a stack-based buffer overflow vulnerability that can be triggered by a remote attacker. The flaw allows for the execution of arbitrary code with high privileges or the triggering of a denial-of-service condition on the device.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a high risk to infrastructure relying on Moxa NPort serial servers. Exploitation could allow an attacker to gain control over connected industrial equipment or cause significant disruption to serial communications, impacting plant-floor operations.

Remediation Plan

Immediate Action: Update the firmware of all affected Moxa NPort 5110 devices to version 2.9 or later.

Proactive Monitoring: Monitor network traffic for unusual activity directed at the NPort devices and maintain strict access control lists (ACLs) to limit management interface exposure.

Compensating Controls: Isolate the NPort devices on a dedicated, non-routable management network to prevent unauthorized remote access.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of June 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using legacy Moxa NPort 5110 devices must ensure they are updated to firmware version 2.9 or later. Given the potential for remote code execution, this should be treated as a high-priority remediation task to secure serial-to-ethernet connectivity.

---METADATA---
VENDOR: Matrix42
PRODUCT: Remote Control Host
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability exists in Matrix42 Remote Control Host 3 that may expose the system to unauthorized access or control.

Executive Summary:
Matrix42 Remote Control Host 3 contains a high-severity vulnerability that could allow unauthorized actors to gain elevated control over affected systems.

Vulnerability Details

CVE-ID: CVE-2016-20095

Affected Software: Matrix42 Remote Control Host

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an issue within the Remote Control Host component, potentially allowing an authenticated or unauthenticated attacker (depending on configuration) to interact with the host environment in an unintended manner.

Business Impact

Successful exploitation of this flaw could lead to a total compromise of the host system, resulting in unauthorized data access, lateral movement within the network, and potential disruption of critical business operations. With a CVSS score of 7.8, this vulnerability represents a significant risk to organizational integrity and should be addressed as a priority to prevent unauthorized administrative access.

Remediation Plan

Immediate Action: Identify all instances of Matrix42 Remote Control Host 3 and apply the latest security patches provided by the vendor.

Proactive Monitoring: Audit remote access logs for unusual connection patterns or unauthorized login attempts originating from unexpected IP addresses.

Compensating Controls: Restrict access to the Remote Control Host service via network-level controls or VPN requirements to minimize the attack surface until patching is complete.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high severity of this vulnerability, administrators must prioritize the identification and remediation of all affected Matrix42 installations. Failure to patch these systems leaves the environment vulnerable to remote exploitation; immediate action is required to maintain the security posture of the network.

---METADATA---
VENDOR: AnyDesk Software GmbH
PRODUCT: AnyDesk
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability identified in AnyDesk version 2 could potentially permit unauthorized access or system-level exploitation.

Executive Summary:
A high-severity security flaw in AnyDesk version 2 presents a critical risk, potentially enabling unauthorized actors to compromise remote desktop sessions or host systems.

Vulnerability Details

CVE-ID: CVE-2016-20094

Affected Software: AnyDesk Software GmbH AnyDesk

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability concerns an undisclosed security weakness in AnyDesk version 2. Because AnyDesk operates with elevated system privileges to facilitate remote control, any flaw in this software represents a severe vector for privilege escalation or unauthorized remote access.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a substantial threat to organizational security. An exploit could allow an attacker to bypass authentication mechanisms, leading to full remote control of the host system, theft of sensitive data, and further lateral movement within the network.

Remediation Plan

Immediate Action: Immediately update the AnyDesk client to the latest stable version provided by the vendor to eliminate the underlying vulnerability.

Proactive Monitoring: Audit remote access logs and monitor for anomalous connection attempts or unrecognized sessions originating from external IP addresses.

Compensating Controls: Implement network-level access controls to restrict AnyDesk traffic to known, trusted endpoints and disable the service when it is not actively required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

AnyDesk is a high-value target for attackers due to its inherent remote access capabilities. It is imperative that organizations verify their current versioning and deploy updates immediately to mitigate the risk of unauthorized remote system control.

---METADATA---
VENDOR: WiseCleaner
PRODUCT: Wise Care 365
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in Wise Care 365 version 4 may expose the system to unauthorized access or potential compromise.

Executive Summary:
A high-severity vulnerability in Wise Care 365 version 4 poses a significant security risk to host systems, potentially allowing for unauthorized system manipulation.

Vulnerability Details

CVE-ID: CVE-2016-20093

Affected Software: WiseCleaner Wise Care 365

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an unspecified security flaw within the Wise Care 365 application. Due to the lack of detailed disclosure, the precise authentication requirements are currently undetermined, though users should assume potential local or remote impact.

Business Impact

The identified vulnerability carries a CVSS score of 7.8, indicating a high level of risk. Successful exploitation could lead to unauthorized system access, data integrity loss, or the execution of arbitrary code, which may result in severe operational disruption and potential compromise of sensitive host information.

Remediation Plan

Immediate Action: Review the official WiseCleaner security portal and apply all available patches or recommended version upgrades immediately.

Proactive Monitoring: Monitor system logs for unusual process execution or unauthorized attempts to access core application files associated with Wise Care 365.

Compensating Controls: Restrict application execution privileges and ensure that the software is run within a hardened environment with minimal necessary permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, administrators must prioritize the assessment of their Wise Care 365 deployments. Until a definitive patch is applied, ensure that the software is not exposed to untrusted network segments and maintain rigorous monitoring of system-level activities.

---METADATA---
VENDOR: NetDrive
PRODUCT: NetDrive 2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
NetDrive 2 contains a security vulnerability that could potentially be leveraged by an attacker to compromise the affected system.

Executive Summary:
A high-severity vulnerability in NetDrive 2 presents a significant security risk, requiring immediate attention to prevent unauthorized system exploitation.

Vulnerability Details

CVE-ID: CVE-2016-20092

Affected Software: NetDrive 2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects NetDrive 2, potentially allowing an attacker to manipulate the application's functionality to gain unauthorized access. The flaw resides within the software's architecture, which may be susceptible to exploitation if not properly patched.

Business Impact

The CVSS score of 7.8 underscores the urgency of this vulnerability. As NetDrive 2 is often used to map network drives, successful exploitation could lead to unauthorized access to remote file systems, sensitive data exfiltration, or the lateral movement of attackers within the internal network.

Remediation Plan

Immediate Action: Verify the version of NetDrive 2 currently in use and apply the latest security updates provided by the vendor immediately.

Proactive Monitoring: Monitor file access logs and network drive connection attempts for anomalous activity that deviates from established user access patterns.

Compensating Controls: Implement strict access control lists (ACLs) on network shares and ensure that endpoint security software is configured to block unauthorized remote connection attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the potential for unauthorized access to network resources, it is imperative that organizations prioritize the patching of NetDrive 2. Security administrators should ensure that all systems are updated and that additional monitoring is in place to detect any potential indicators of compromise.

---METADATA---
VENDOR: Malwarebytes
PRODUCT: Windows Firewall Control
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in Malwarebytes Windows Firewall Control may allow for unauthorized security policy manipulation.

Executive Summary:
Windows Firewall Control contains a high-severity vulnerability that could allow an attacker to bypass or modify critical security policies on the host system.

Vulnerability Details

CVE-ID: CVE-2016-20091

Affected Software: Malwarebytes Windows Firewall Control

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Windows Firewall Control utility, potentially allowing an attacker to interact with the software to weaken or disable firewall rules. Such flaws typically involve insecure handling of process communications or improper authorization checks for administrative tasks.

Business Impact

A CVSS score of 7.8 indicates a high risk to host security. If an attacker successfully exploits this flaw, they could disable firewall protections, effectively leaving the system vulnerable to further exploitation, lateral movement, and unauthorized network access.

Remediation Plan

Immediate Action: Update Windows Firewall Control to the latest version provided by Malwarebytes to ensure all security patches are applied.

Proactive Monitoring: Monitor system logs for unauthorized configuration changes to the Windows Firewall or unexpected termination of security services.

Compensating Controls: Ensure that Endpoint Detection and Response (EDR) tools are configured to alert on unauthorized modifications to firewall settings or local security policies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability directly impacts the integrity of the host's firewall protection, it must be addressed immediately. Administrators should prioritize updating the software across all managed endpoints to prevent attackers from bypassing network security controls.

---METADATA---
VENDOR: Comodo
PRODUCT: Dragon Browser
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Comodo Dragon Browser versions up to 52 contain a security vulnerability that may facilitate unauthorized system access.

Executive Summary:
A high-severity security flaw in Comodo Dragon Browser allows for potential exploitation, necessitating urgent updates to maintain endpoint integrity.

Vulnerability Details

CVE-ID: CVE-2016-20090

Affected Software: Comodo Dragon Browser

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This issue impacts Comodo Dragon Browser versions up to 52. The vulnerability could be leveraged to bypass security controls, potentially granting an attacker the ability to execute arbitrary code or interfere with browser operations.

Business Impact

With a CVSS score of 7.8, this vulnerability represents a substantial risk to organizational security. Compromise of the browser environment often leads to the exposure of credentials, cookies, and sensitive browsing data, which can be further leveraged to escalate access within the corporate network.

Remediation Plan

Immediate Action: Update all deployments of Comodo Dragon Browser to the latest version provided by the vendor to remediate the underlying flaw.

Proactive Monitoring: Monitor endpoint logs for suspicious behavior, specifically focusing on unauthorized child processes spawned by the browser application.

Compensating Controls: Utilize Web Application Firewalls (WAF) and network-level traffic analysis to detect and block malicious payloads that attempt to exploit browser vulnerabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately audit their asset inventory to locate all instances of the affected browser. Prompt remediation is critical to neutralizing the risk of unauthorized access and ensuring that browser security remains commensurate with organizational standards.