---METADATA---
VENDOR: WooCommerce
PRODUCT: WooCommerce
AFFECTED_VERSIONS: 7.1.0
---END_METADATA---

Description Summary:
WooCommerce 7.1.0 contains a remote code execution vulnerability allowing attackers to inject arbitrary PHP code via the product-type parameter.

Executive Summary:
A critical remote code execution vulnerability in WooCommerce 7.1.0 allows unauthorized attackers to inject and execute arbitrary PHP code on the web server.

Vulnerability Details

CVE-ID: CVE-2022-50972

Affected Software: WooCommerce WooCommerce

Affected Versions: 7.1.0

Vulnerability: The vulnerability exists in the class-wc-meta-box-product-images.php endpoint, which fails to properly sanitize the product-type parameter. An unauthenticated attacker can exploit this to write malicious PHP files to the server's web root, resulting in full remote code execution.

Business Impact

The CVSS score of 9.8 highlights the extreme risk of this vulnerability. Successful exploitation permits attackers to gain full control over the web server, facilitating the theft of customer databases, installation of webshells, and potential pivoting into the broader corporate network.

Remediation Plan

Immediate Action: Update the WooCommerce plugin to a patched version beyond 7.1.0 immediately.

Proactive Monitoring: Audit the web root and plugin directories for newly created or unauthorized .php files that may have been injected via this vector.

Compensating Controls: Implement file integrity monitoring (FIM) and configure WAF rules to block requests containing suspicious input within the product-type parameter.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jun 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a direct path to server compromise and must be addressed with the highest urgency. Administrators should apply the latest security updates provided by WooCommerce and ensure that web directory permissions are restricted to prevent unauthorized file creation.

---METADATA---
VENDOR: Malwarebytes
PRODUCT: Malwarebytes
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability in Malwarebytes 4 could potentially lead to unauthorized access or system instability.

Executive Summary:
Malwarebytes 4 contains a high-severity vulnerability that poses a significant risk to the security and stability of protected endpoints.

Vulnerability Details

CVE-ID: CVE-2022-50971

Affected Software: Malwarebytes

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the core service components of Malwarebytes 4, potentially allowing for privilege escalation or unauthorized control over the security application. The flaw could be leveraged to subvert existing security protections if an attacker gains local access to the system.

Business Impact

With a CVSS score of 7.8, this vulnerability is critical for organizations that rely on Malwarebytes for endpoint protection. If exploited, an attacker could disable security agents, leading to a total loss of visibility and defense-in-depth, potentially resulting in widespread malware infection and data exfiltration across the corporate network.

Remediation Plan

Immediate Action: Update all Malwarebytes 4 installations to the latest version recommended by the vendor to ensure all security patches are applied.

Proactive Monitoring: Monitor for unexpected service restarts or modifications to the Malwarebytes configuration files that might indicate tampering.

Compensating Controls: Use Group Policy or centralized management consoles to restrict unauthorized configuration changes to the security agent.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the essential role of security software, any vulnerability within Malwarebytes 4 must be addressed with high priority. Organizations are advised to verify their current patch levels and perform updates immediately to maintain the integrity of their endpoint security posture.

---METADATA---
VENDOR: MegaTKC
PRODUCT: Aero CMS
AFFECTED_VERSIONS: 0.0.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A code injection vulnerability in MegaTKC Aero CMS 0.0.1 allows an authenticated attacker to execute arbitrary code via the posts.php component.

Executive Summary:
An authenticated code injection vulnerability in Aero CMS 0.0.1 poses a high risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2022-50944

Affected Software: MegaTKC Aero CMS

Affected Versions: 0.0.1

Vulnerability: This is a code injection vulnerability (CWE-94) residing in the posts.php component. The vulnerability requires the attacker to have low-level privileges (PR:L) to successfully trigger the injection.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code, potentially leading to full system compromise, data exfiltration, or unauthorized administrative control. With a CVSS score of 8.8, this represents a high-severity threat that could result in significant operational disruption and loss of sensitive data.

Remediation Plan

Immediate Action: Review official vendor communications for available security patches and apply them immediately. If no official patch is released, disable the affected functionality or restrict access to the CMS administrative interfaces.

Proactive Monitoring: Monitor server access logs for suspicious POST requests targeting posts.php and look for anomalous execution patterns from authenticated user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common code injection payloads targeting PHP environments.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public exploit on ExploitDB significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the high CVSS score and the availability of a public exploit, administrators must treat this vulnerability with high urgency. Organizations should prioritize patching or implementing restrictive access controls to prevent unauthorized code execution.

---METADATA---
VENDOR: Telcel
PRODUCT: FLAME II MODEM USB
AFFECTED_VERSIONS: Unknown
CONFIDENCE: medium
MISSING: versions, patch
---END_METADATA---

Description Summary:
The Telcel FLAME II HSPA USB Modem contains an unquoted service path vulnerability in its Windows service, allowing local attackers to execute arbitrary code with system-level privileges.

Executive Summary:
A critical local privilege escalation vulnerability in the Telcel FLAME II USB Modem allows attackers to achieve SYSTEM-level code execution via an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2022-50935

Affected Software: Telcel FLAME II MODEM USB

Affected Versions: Unknown

Vulnerability: The software uses an unquoted service path for the application controller (CWE-428). A local attacker can place a malicious executable in a parent directory, which the service will execute with elevated system privileges upon startup.

Business Impact

Successful exploitation grants an attacker full control over the host machine, including the ability to install persistent malware, steal credentials, or pivot into the local network. With a CVSS score of 9.8, this vulnerability represents a severe risk to any workstation or server where this modem software is installed.

Remediation Plan

Immediate Action: Identify and uninstall the affected Telcel modem software if it is no longer required for operations.

Proactive Monitoring: Audit Windows services for unquoted paths using tools like PowerShell (e.g., Get-WmiObject win32_service) and monitor for the creation of unauthorized executables in the C:\Program Files (x86)\ directory.

Compensating Controls: Implement strict file system permissions on the C:\Program Files (x86)\Internet Telcel\ directory to prevent unauthorized users from writing files to the directory path.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of Jan 13, 2026, there is no public information indicating active exploitation in the wild; however, a public exploit is available via ExploitDB. The vulnerability is inherently exploitable by any local user with permissions to write to the file system.

Analyst Recommendation

Organizations should audit their environment for the presence of this legacy modem software and remove it immediately. If the software is mission-critical, ensure strict access control policies are applied to the installation directory to prevent local privilege escalation.

---METADATA---
VENDOR: WAGO
PRODUCT: 750-8212 PFC200 G2 2ETH RS
AFFECTED_VERSIONS: Firmware version 03.05.10(17)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
WAGO PFC200 G2 firmware contains a privilege escalation vulnerability where attackers can manipulate user session cookies to gain administrative access without proper authentication.

Executive Summary:
A critical privilege escalation vulnerability in WAGO PFC200 G2 firmware allows attackers to elevate to administrative privileges by manipulating session cookie parameters.

Vulnerability Details

CVE-ID: CVE-2022-50926

Affected Software: WAGO 750-8212 PFC200 G2 2ETH RS

Affected Versions: Firmware version 03.05.10(17)

Vulnerability: The firmware fails to validate or verify the integrity of user session cookies (CWE-565). By modifying the 'name' and 'roles' parameters within the cookie, a low-privileged user can gain administrative access to the device.

Business Impact

This vulnerability allows an attacker to bypass authentication and gain full administrative control over the PLC. This could lead to unauthorized modification of industrial processes, disruption of critical infrastructure, or full device compromise, resulting in significant operational and safety impacts.

Remediation Plan

Immediate Action: Contact WAGO support to obtain the latest firmware update that addresses this session integrity issue.

Proactive Monitoring: Monitor device traffic for anomalous HTTP requests involving session cookie modification and audit administrative logs for unauthorized account changes.

Compensating Controls: Use network segmentation to ensure the PLC management interface is not exposed to untrusted networks and utilize VPNs or jump servers to restrict access to authorized personnel only.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of Jan 13, 2026, there is no public information indicating active exploitation in the wild; however, a public exploit is available via ExploitDB. The flaw is easily triggered by any user capable of intercepting and modifying web traffic.

Analyst Recommendation

Due to the availability of a public exploit and the critical nature of the impact, users of the WAGO 750-8212 PFC200 G2 should immediately restrict management access to the device and coordinate with WAGO to apply the necessary firmware remediation.

---METADATA---
VENDOR: Prowise
PRODUCT: Prowise Reflect
AFFECTED_VERSIONS: V1.0.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Prowise Reflect version 1.0.9 is vulnerable to remote keystroke injection via an exposed WebSocket on port 8082, allowing unauthenticated attackers to execute arbitrary keyboard commands.

Executive Summary:
Prowise Reflect version 1.0.9 contains a critical remote keystroke injection vulnerability that enables unauthenticated attackers to execute arbitrary commands on the host system.

Vulnerability Details

CVE-ID: CVE-2022-50925

Affected Software: Prowise Prowise Reflect

Affected Versions: V1.0.9

Vulnerability: The application fails to properly validate the origin of requests sent to a WebSocket service on port 8082, allowing an unauthenticated remote attacker to inject malicious keystrokes.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting a critical severity level. Successful exploitation allows an attacker to interact with the host system as if they had physical keyboard access, potentially leading to unauthorized application execution, data exfiltration, or complete system compromise.

Remediation Plan

Immediate Action: Consult the official Prowise support portal for patch availability and apply the latest security updates immediately.

Proactive Monitoring: Monitor network traffic directed toward port 8082 for unauthorized or anomalous WebSocket connection attempts.

Compensating Controls: Restrict network access to port 8082 using host-based firewalls or network access control lists to ensure only authorized management traffic is permitted.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of Jan 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of authentication required to interact with the injection vector.

Analyst Recommendation

Given the critical nature of this remote code execution vector, organizations using Prowise Reflect should prioritize mitigation. If a patch is not immediately available, isolating the affected system from untrusted networks is mandatory to prevent unauthorized remote interaction.

---METADATA---
VENDOR: Litexmedia
PRODUCT: Audio Conversion Wizard
AFFECTED_VERSIONS: 2.01
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Audio Conversion Wizard v2.01 contains a buffer overflow vulnerability triggered by a malformed registration code, allowing potential arbitrary code execution.

Executive Summary:
Audio Conversion Wizard v2.01 is susceptible to a buffer overflow vulnerability that may allow an attacker to achieve arbitrary code execution via crafted user input.

Vulnerability Details

CVE-ID: CVE-2022-50922

Affected Software: Litexmedia Audio Conversion Wizard

Affected Versions: 2.01

Vulnerability: The application fails to perform adequate bounds checking on registration code input, leading to a classic buffer overflow that can overwrite memory and facilitate remote code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe risk to system integrity. Exploitation could result in the execution of arbitrary code with the privileges of the application, potentially leading to full system compromise and loss of data confidentiality.

Remediation Plan

Immediate Action: Update to the latest version of Audio Conversion Wizard provided by Litexmedia to resolve the memory management flaw.

Proactive Monitoring: Review system logs for application crashes or abnormal process termination, which may indicate attempted exploitation of buffer overflow conditions.

Compensating Controls: Employ Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) at the operating system level to hinder the successful execution of memory-based exploits.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of Jan 13, 2026, there is no public information indicating active exploitation or a confirmed public proof-of-concept for this specific vulnerability in the wild. The vulnerability is highly exploitable due to the lack of input validation on a common user-supplied parameter.

Analyst Recommendation

Users should immediately update to the latest software release to remediate this vulnerability. Until an update is applied, users should avoid entering registration codes from untrusted sources and restrict the application's environment to prevent lateral movement.

---METADATA---
VENDOR: Tdarr
PRODUCT: Tdarr
AFFECTED_VERSIONS: 2.00.15
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Tdarr 2.00.15 is susceptible to unauthenticated remote code execution via command injection in the Help terminal, allowing attackers to execute arbitrary commands.

Executive Summary:
A critical unauthenticated remote code execution vulnerability exists in Tdarr 2.00.15, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2022-50919

Affected Software: Tdarr Tdarr

Affected Versions: 2.00.15

Vulnerability: This is a command injection vulnerability located in the Help terminal component. The application fails to perform adequate input filtering, allowing an unauthenticated attacker to inject and chain arbitrary system commands.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code on the host server presents a critical business risk. Successful exploitation could lead to full system takeover, unauthorized access to sensitive media processing data, and potential lateral movement within the network. With a CVSS score of 9.8, this vulnerability is classified as critical and requires immediate attention to prevent catastrophic data breaches or service disruption.

Remediation Plan

Immediate Action: Update Tdarr to the latest available version as provided by the vendor to resolve the command injection flaw.

Proactive Monitoring: Review system and application access logs for unusual command strings or suspicious child processes originating from the Tdarr service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious command injection patterns targeting terminal or help parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS 9.8 rating and the ability for unauthenticated attackers to achieve remote code execution, this vulnerability poses a severe threat. Administrators should prioritize updating the Tdarr software immediately and isolate affected systems from the public internet until the patch is successfully applied.

---METADATA---
VENDOR: ImpressCMS
PRODUCT: ImpressCMS
AFFECTED_VERSIONS: 1.4.4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
ImpressCMS 1.4.4 contains a file upload vulnerability where inadequate extension sanitization allows attackers to upload and execute malicious PHP files.

Executive Summary:
An unauthenticated arbitrary file upload vulnerability in ImpressCMS 1.4.4 allows attackers to execute malicious code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2022-50912

Affected Software: ImpressCMS ImpressCMS

Affected Versions: 1.4.4

Vulnerability: The vulnerability stems from weak extension sanitization during the file upload process. An attacker can bypass security restrictions by utilizing alternative PHP extensions (e.g., .php2, .php6, .php7) to upload and subsequently execute arbitrary code.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain remote code execution capabilities on the web server. This can lead to total site compromise, defacement, data exfiltration, or the installation of backdoors for persistent access. Given the CVSS score of 9.8, this flaw represents a critical threat to the confidentiality, integrity, and availability of the ImpressCMS platform.

Remediation Plan

Immediate Action: Upgrade to the latest version of ImpressCMS to implement robust file upload validation and extension filtering.

Proactive Monitoring: Monitor the web server’s upload directories for unauthorized files and review server logs for suspicious execution attempts of non-standard PHP extensions.

Compensating Controls: Implement strict file type validation at the web server level and restrict execution permissions for directories where user uploads are stored.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly severe because it allows for direct server-side code execution. Organizations running ImpressCMS 1.4.4 must treat this as a high-priority remediation task and deploy the vendor-supplied update immediately to prevent unauthorized access and potential malware deployment.

Executive Summary:
A high-severity vulnerability has been identified in certain products, specifically Bitrix24, which allows an authenticated attacker to execute arbitrary code on the server. Successful exploitation of this vulnerability could lead to a complete system compromise, enabling attackers to steal sensitive data, disrupt business operations, or use the compromised system to launch further attacks.

Vulnerability Details

CVE-ID: CVE-2022-50911

Affected Software: Unknown Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is an authenticated remote code execution (RCE) vulnerability within the Bitrix24 platform. An attacker who has valid user credentials can leverage the PHP command line admin interface to execute arbitrary system commands on the underlying server. To exploit this, an attacker would first need to log into a vulnerable Bitrix24 instance, navigate to the administrative PHP command interface, and then input malicious system-level commands which the application would execute with the permissions of the web server's user account.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. A successful exploit could have a significant negative impact on the business, leading to a complete compromise of the server hosting the Bitrix24 application. Potential consequences include the theft of confidential corporate data, customer information, and intellectual property; disruption of critical business workflows managed through the platform; reputational damage; and financial losses associated with incident response and recovery. The compromised server could also be used as a foothold to pivot into the broader corporate network.

Remediation Plan

Immediate Action: Identify all internet-facing and internal Bitrix24 systems and apply the security patches provided by the vendor immediately. Prioritize systems that are exposed to the internet. After patching, review access and web server logs for any signs of compromise or unusual activity preceding the patch application.

Proactive Monitoring: Implement enhanced logging and monitoring for all Bitrix24 instances. Security teams should actively monitor for unusual processes being spawned by the web server (e.g., sh, bash, powershell), unexpected outbound network connections from the server, and logs showing suspicious commands being executed through the PHP admin interface.

Compensating Controls: If immediate patching is not feasible, implement the following controls to reduce risk:

• Restrict network access to the Bitrix24 administrative portal to only trusted IP addresses.
• Deploy a Web Application Firewall (WAF) with rules designed to detect and block command injection attack patterns.
• Review all user accounts with administrative access and enforce the principle of least privilege, removing unnecessary permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 14, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the nature of the vulnerability, an exploit would be straightforward for a skilled attacker with valid credentials to create. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high severity (CVSS 8.8) of this remote code execution vulnerability, immediate action is required. Organizations must prioritize applying the vendor-supplied patches to all affected Bitrix24 instances, especially those exposed to the internet. While this vulnerability is not currently listed in the CISA KEV catalog, the potential for complete system compromise necessitates a swift and decisive response to prevent future exploitation. A thorough review of user accounts and access controls should also be conducted to minimize the attack surface.

Executive Summary:
A critical vulnerability has been identified in multiple products, allowing attackers to execute malicious code within a user's browser through two distinct cross-site scripting (XSS) attacks. Successful exploitation could lead to session hijacking, credential theft, or the delivery of further malware, posing a significant risk to the confidentiality and integrity of user data and the affected web application.

Vulnerability Details

CVE-ID: CVE-2022-50905

Affected Software: Unknown Multiple Products

Affected Versions: Version 3.2.1 is confirmed to be vulnerable. See vendor advisory for a complete list of affected versions.

Vulnerability: This CVE encompasses two separate cross-site scripting vulnerabilities:

1. Reflected XSS: An authenticated user can be tricked into clicking a specially crafted URL. When the user interacts with the news comment form on the news.php page (specifically, by typing in the comment field and then clicking outside of it), malicious JavaScript code embedded in the URL parameter is executed in their browser.
2. Stored XSS via File Upload: An authenticated administrator can bypass file upload restrictions in the media manager's remote URL upload feature (image.php). This allows the administrator to upload a Scalable Vector Graphics (SVG) file containing malicious JavaScript. When any user subsequently views or accesses this malicious SVG file, the embedded script executes in their browser, leading to a stored XSS attack.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8. Exploitation can have severe consequences for the business, including the compromise of user and administrator accounts through session hijacking and credential theft. This could lead to unauthorized access to sensitive data, website defacement, distribution of malware to visitors, and reputational damage. An attacker gaining administrator-level access could potentially pivot to compromise the underlying server and other internal network resources, escalating the incident from a web application breach to a full network compromise.

Remediation Plan

Immediate Action: Update Unknown Multiple Products to the latest version. Monitor for exploitation attempts and review access logs.

Proactive Monitoring:

• Review web server access logs for unusual or lengthy URL parameters targeting news.php, which may indicate reflected XSS attempts.
• Monitor media manager and server file system logs for the upload of SVG files, particularly through the remote URL upload feature.
• Implement and monitor alerts from a Web Application Firewall (WAF) for XSS attack signatures and unauthorized file type uploads.

Compensating Controls:

• If immediate patching is not feasible, implement a WAF with strict XSS filtering rules to block malicious requests.
• Enforce a strong Content Security Policy (CSP) to prevent the execution of untrusted inline scripts and scripts from unauthorized sources.
• Disable the remote URL file upload feature within the media manager or restrict its use to highly trusted administrators.
• Configure the web server to serve all user-uploaded files, including SVGs, with a Content-Type header (e.g., text/plain) that prevents them from being rendered as active content by browsers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jan 13, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the critical CVSS score of 9.8, it is strongly recommended that organizations patch all affected systems immediately. The combination of both reflected and stored XSS vectors provides attackers with multiple avenues for exploitation against different user privilege levels. Although there is no evidence of active exploitation at this time, the high severity rating makes it a probable target for future threat actor activity. If patching cannot be performed immediately, the compensating controls listed above, particularly the use of a WAF and a restrictive Content Security Policy, should be implemented as a matter of urgency.

Executive Summary:
A critical SQL injection vulnerability exists in VIAVIWEB Wallpaper Admin products, identified as CVE-2022-50894. This flaw allows an authenticated attacker to manipulate database queries and steal sensitive information, such as user credentials and configuration data. Due to the high severity (CVSS 9.8), successful exploitation could lead to a complete compromise of the application's database, resulting in a significant data breach.

Vulnerability Details

CVE-ID: CVE-2022-50894

Affected Software: VIAVIWEB Wallpaper Admin Multiple Products

Affected Versions: Version 1.0 is confirmed to be vulnerable. See vendor advisory for a complete list of specific affected products and versions.

Vulnerability: The vulnerability is an SQL injection flaw in the edit_gallery_image.php script. An authenticated attacker can exploit this by sending a specially crafted GET request where the img_id parameter contains malicious SQL code. Because the application fails to properly sanitize this user-supplied input, the malicious code is executed directly by the database, allowing the attacker to bypass security controls and exfiltrate sensitive data from the database.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, posing a significant risk to the organization. A successful attack could result in a complete loss of data confidentiality and integrity within the application's database. Potential consequences include the theft of user credentials, personal information, and other sensitive data, leading to reputational damage, regulatory penalties, and financial loss. While the vulnerability requires authentication, a low-privileged user account is sufficient to launch a high-impact attack.

Remediation Plan

Immediate Action: The primary remediation is to apply the vendor-supplied security patches immediately. Upgrade all instances of VIAVIWEB Wallpaper Admin to the latest secure version to resolve the vulnerability.

Proactive Monitoring: System administrators should actively monitor web server and application logs for suspicious activity targeting edit_gallery_image.php. Look for GET requests with unusual or malformed img_id parameters containing SQL keywords (e.g., UNION, SELECT, --, ' OR '1'='1'). Monitor for anomalous database query patterns or unexpected outbound network traffic that could indicate data exfiltration.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to detect and block SQL injection attacks. Additionally, enforce the principle of least privilege for the application's database user account to limit the potential impact of a successful exploit.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of January 13, 2026, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, SQL injection is a well-understood vulnerability class, and proof-of-concept exploits are simple to create and are likely available in the public domain. The requirement for authentication reduces the attack surface but does not eliminate the risk, especially from insider threats or attackers who have compromised a user account.

Analyst Recommendation

Given the critical severity (CVSS 9.8) and the high potential for data exfiltration, it is strongly recommended that organizations prioritize patching this vulnerability immediately. All affected VIAVIWEB Wallpaper Admin instances should be upgraded to the latest version without delay. In parallel, security teams should review access logs for any evidence of past exploitation attempts. If patching is delayed for any reason, the implementation of compensating controls, such as a WAF, is crucial to mitigate the immediate risk.

Executive Summary:
A critical vulnerability exists in VIAVIWEB Wallpaper Admin software that allows an unauthenticated attacker to take complete control of the web server. By uploading a malicious file disguised as an image, an attacker can execute arbitrary code, leading to potential data theft, service disruption, and full system compromise. This vulnerability requires immediate attention due to its high severity and ease of exploitation.

Vulnerability Details

CVE-ID: CVE-2022-50893

Affected Software: VIAVIWEB Wallpaper Admin Multiple Products

Affected Versions: Version 1.0 is confirmed to be vulnerable. See vendor advisory for a complete list of affected products and versions.

Vulnerability: The vulnerability is an unauthenticated Remote Code Execution (RCE) flaw within the image upload functionality. The specific endpoint, add_gallery_image.php, fails to properly validate the type of file being uploaded and does not require any authentication to access. An attacker can craft a malicious PHP script, save it with an image file extension (or bypass client-side checks), and upload it to the server. Once uploaded, the attacker can navigate to the file's location on the server, causing the web server to execute the embedded PHP code with the permissions of the web server process.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, reflecting the extreme risk it poses to the organization. Successful exploitation could lead to a complete compromise of the affected server, resulting in the theft of sensitive data, including customer information, intellectual property, and credentials. An attacker could also deface the website, disrupt business operations by deleting files or shutting down services, or use the compromised server as a pivot point to launch further attacks against the internal network or to host malware. The potential for significant financial loss, reputational damage, and regulatory fines is high.

Remediation Plan

Immediate Action:

• Immediately apply the security patches provided by the vendor. Update all instances of VIAVIWEB Wallpaper Admin to the latest available version to mitigate this vulnerability.
• Begin actively monitoring web server access logs for any POST requests to the add_gallery_image.php endpoint, especially from unknown IP addresses.
• Review the contents of image upload directories for any suspicious or non-image files (e.g., files with extensions like .php, .phtml, .php5).

Proactive Monitoring:

• Implement log analysis rules to generate alerts for any attempts to upload files with script-based extensions to image directories.
• Monitor for unusual outbound network traffic originating from the web server, which could indicate a successful compromise and communication with a command-and-control server.
• Use a file integrity monitoring (FIM) solution to detect unauthorized changes to files in the web application's directories.

Compensating Controls:

• If immediate patching is not feasible, use a Web Application Firewall (WAF) with rules designed to inspect file uploads and block malicious file types.
• Configure the web server to deny access to the add_gallery_image.php endpoint from all untrusted IP addresses.
• Modify web server configuration to prevent the execution of scripts (e.g., PHP) within the designated image upload directories.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of January 13, 2026, this vulnerability is publicly disclosed, and proof-of-concept exploits for similar unrestricted file upload vulnerabilities are widely available. The lack of an authentication requirement makes this flaw trivial to exploit. While this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its critical severity and ease of exploitation make it a highly attractive target for threat actors.

Analyst Recommendation
Given the critical CVSS score of 9.8 and the unauthenticated nature of this remote code execution vulnerability, we recommend immediate and urgent action. The risk of a full system compromise is extremely high. Organizations must prioritize applying the vendor-supplied patches to all affected systems without delay. If patching cannot be performed immediately, the compensating controls listed above, particularly restricting access to the vulnerable endpoint and disabling script execution in upload directories, should be implemented as an emergency mitigation measure.

---METADATA---
VENDOR: Concrete5
PRODUCT: CMS
AFFECTED_VERSIONS: 9.1.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Concrete5 CMS 9.1.3 is vulnerable to XPath injection, allowing attackers to manipulate URL path parameters to extract sensitive system information.

Executive Summary:
An XPath injection vulnerability in Concrete5 CMS 9.1.3 allows attackers to manipulate system queries, potentially leading to the disclosure of sensitive internal information.

Vulnerability Details

CVE-ID: CVE-2022-50807

Affected Software: Concrete5 CMS

Affected Versions: 9.1.3

Vulnerability: The application is susceptible to XPath injection via URL path parameters. By flooding the system with crafted malicious payloads, an attacker can manipulate the underlying query structure to extract internal content paths and system metadata.

Business Impact

While this vulnerability primarily facilitates information disclosure, the exposure of internal system architecture and content paths significantly aids attackers in planning further, more destructive attacks. The critical CVSS score of 9.8 suggests that this vulnerability could be a precursor to deeper system exploitation. Protecting this information is vital for maintaining the overall security posture and preventing reconnaissance-based attacks.

Remediation Plan

Immediate Action: Update the Concrete5 CMS installation to the latest version, which includes patches for input sanitization.

Proactive Monitoring: Monitor web application logs for high volumes of unusual request patterns or URL structures containing XPath-related syntax.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block common injection-based attack patterns targeting URL parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

XPath injection vulnerabilities allow attackers to bypass standard protections and probe the internal workings of the CMS. It is recommended that administrators update the application immediately and conduct a security review of the web server logs to ensure no unauthorized reconnaissance has occurred.

Executive Summary:
A critical vulnerability has been identified in JM-DATA ONU devices, specifically version 1.0.67 of the JF511-TV model. The device uses static, default credentials which, if unchanged, allow unauthenticated attackers to gain full administrative control, posing a severe risk of network compromise, data interception, and service disruption.

Vulnerability Details

CVE-ID: CVE-2022-50803

Affected Software: JM-DATA ONU JF511-TV (and potentially other products)

Affected Versions: version 1.0.67

Vulnerability: The vulnerability exists due to the use of hardcoded, default credentials for administrative access. An attacker with network access to the device's management interface can use these publicly known credentials to log in with the highest level of privileges. This allows the attacker to view or modify all device configurations, monitor network traffic passing through the device, disable services, or use the compromised device as a pivot point to launch further attacks against the internal network.

Business Impact

This vulnerability is rated as critical, with a CVSS score of 9.8, reflecting the extreme ease of exploitation and the potential for complete system compromise. Successful exploitation could lead to significant business disruption, including loss of internet connectivity, unauthorized access to sensitive internal network resources, and data exfiltration. An attacker could manipulate network traffic, conduct man-in-the-middle attacks, or install persistent backdoors, severely impacting the confidentiality, integrity, and availability of business operations and data.

Remediation Plan

Immediate Action: The primary remediation step is to immediately change the default administrative password on all affected JM-DATA ONU devices. If a vendor-supplied firmware update is available to address this issue, it should be applied as soon as possible. Organizations should also review access logs for any signs of unauthorized logins using the default credentials.

Proactive Monitoring: Implement continuous monitoring of network device logs, specifically looking for successful or repeated failed login attempts to management interfaces from untrusted IP addresses. Monitor for unexpected configuration changes, unusual outbound traffic originating from the ONU device, or alterations to DNS settings, as these can be indicators of compromise.

Compensating Controls: If patching or changing credentials is not immediately feasible, restrict network access to the device's management interface (e.g., web portal, SSH, Telnet) to a limited set of trusted administrative IP addresses. Employ network segmentation to isolate the ONU device from critical internal network segments, limiting the potential impact of a compromise.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Dec 30, 2025, the "exploit" for this vulnerability is the public knowledge of the default credentials. This makes exploitation trivial for any attacker who can access the device's login interface. While this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, vulnerabilities involving default credentials are a common target for automated scanning and opportunistic attacks.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the trivial nature of exploitation, we strongly recommend that organizations take immediate action. All affected JM-DATA ONU devices must be identified and their default credentials must be changed without delay. Even though this vulnerability is not on the CISA KEV list, its high severity presents a clear and present danger to the network, and remediation should be treated as a top priority.

Executive Summary:
This report details a high-severity user enumeration vulnerability in H3C SSL VPN products, identified as CVE-2022-50800. The flaw allows unauthenticated attackers to remotely confirm the existence of valid usernames, which can then be used in targeted attacks like password spraying to gain unauthorized access to the corporate network. Organizations are urged to apply vendor patches immediately to mitigate the risk of a potential network breach.

Vulnerability Details

CVE-ID: CVE-2022-50800

Affected Software: Unknown Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in the login functionality of H3C SSL VPN solutions. An unauthenticated remote attacker can exploit this flaw by sending specially crafted POST requests to the login interface, manipulating the 'txtUsrName' parameter. The system provides a distinguishable response based on whether the submitted username is valid or invalid, allowing the attacker to systematically test a list of potential usernames and build a definitive list of valid accounts on the system.

Business Impact

This vulnerability is rated as high severity with a CVSS score of 7.5. Successful exploitation provides attackers with the foundational information needed for more advanced attacks. By obtaining a list of valid usernames, attackers can conduct highly effective password spraying or brute-force campaigns, significantly increasing the likelihood of account compromise and unauthorized access to the internal network. This could lead to data breaches, ransomware deployment, or further lateral movement within the organization's infrastructure.

Remediation Plan

Immediate Action: Apply the security updates provided by the vendor (H3C) across all affected SSL VPN appliances without delay. After patching, review VPN access logs for any signs of enumeration attempts or unusual login patterns that may have occurred prior to remediation.

Proactive Monitoring: Security teams should actively monitor VPN logs for a high volume of failed login attempts from a single source IP address targeting multiple usernames. Implement alerting for rapid, sequential POST requests to the VPN login page. Monitor for successful logins that immediately follow a burst of failed attempts from the same IP, as this could indicate a successful password-spraying attack.

Compensating Controls: If immediate patching is not feasible, implement the following controls:

• Use a Web Application Firewall (WAF) to enforce strict rate-limiting on the VPN login page to slow down or block automated enumeration attempts.
• Enforce Multi-Factor Authentication (MFA) for all VPN users to ensure that a compromised password alone is not sufficient for access.
• Ensure a robust account lockout policy is in place to temporarily disable accounts after a set number of failed login attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of December 31, 2025, there are no known public exploits specifically targeting this CVE. However, user enumeration is a common and well-understood attack technique, and scripts to exploit this type of vulnerability are trivial for a skilled attacker to create.

Analyst Recommendation

Given the high CVSS score of 7.5 and the critical role this vulnerability plays as a precursor to account compromise, we strongly recommend that organizations prioritize the immediate application of vendor-supplied patches. While this CVE is not currently on the CISA KEV list, its potential to facilitate unauthorized network access makes it a significant risk. Organizations should treat this as an urgent priority and implement compensating controls like MFA and rate-limiting to add layers of defense against this threat.