@seclists.org.fulldisclosure@rss-parrot.net
I'm an automated parrot! I relay a website's RSS feed to the Fediverse. Every time a new post appears in the feed, I toot about it. Follow me to get all new posts in your Mastodon timeline! Brought to you by the RSS Parrot.
---
A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.
Site URL: seclists.org/#fulldisclosure
Feed URL: seclists.org/rss/fulldisclosure.rss
Posts: 10
Followers: 2
[0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2)
https://seclists.org/fulldisclosure/2026/Sep/40
Published: September 8, 2026 17:31
Posted by disclosure via Fulldisclosure on Sep 08TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] Royal Server 5.04.50529.0 Local privilege escalation to LocalSystem on the execution path without credential override (7.2) FROM: disclosure ()…
[0day-rubbish] core-admin 1.0.164 (build 16468) Systemic shell command injection via ineffective quote escaping (8.8)
https://seclists.org/fulldisclosure/2026/Sep/39
Published: September 8, 2026 17:31
Posted by disclosure via Fulldisclosure on Sep 08TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] core-admin 1.0.164 (build 16468) Systemic shell command injection via ineffective quote escaping (8.8) FROM: disclosure () 0day-rubbish com…
[0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8)
https://seclists.org/fulldisclosure/2026/Sep/38
Published: September 8, 2026 17:31
Posted by disclosure via Fulldisclosure on Sep 08TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] OP5 Monitor 9.20 Command injection surviving the CVE-2025-34115 patch (OPT-IN fix ineffective) (8.8) FROM: disclosure () 0day-rubbish com…
[0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field (8.8)
https://seclists.org/fulldisclosure/2026/Sep/37
Published: September 8, 2026 17:31
Posted by disclosure via Fulldisclosure on Sep 08TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] QuantaStor 6.8.3.018 Command injection in the alert-mail command via the smtpPassword field (8.8) FROM: disclosure () 0day-rubbish com ----BODY----…
[0day-rubbish] SmarterMail 100.0.9693 (Build 9693) Antivirus command-line configuration executing as NT AUTHORITY\SYSTEM (7.2)
https://seclists.org/fulldisclosure/2026/Sep/36
Published: September 8, 2026 17:31
Posted by disclosure via Fulldisclosure on Sep 08TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] SmarterMail 100.0.9693 (Build 9693) Antivirus command-line configuration executing as NT AUTHORITY\SYSTEM (7.2) FROM: disclosure () 0day-rubbish…
[0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded credentials leading to OS command execution (9.8)
https://seclists.org/fulldisclosure/2026/Sep/35
Published: September 8, 2026 17:31
Posted by disclosure via Fulldisclosure on Sep 08TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded credentials leading to OS command execution (9.8)…
[0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading to JNDI remote class loading (9.8)
https://seclists.org/fulldisclosure/2026/Sep/34
Published: September 8, 2026 17:31
Posted by disclosure via Fulldisclosure on Sep 08TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] Accurate Online Private Cloud on-prem (current) Unauthenticated Hessian deserialization leading to JNDI remote class loading (9.8) FROM: disclosure…
[0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)
https://seclists.org/fulldisclosure/2026/Sep/33
Published: September 8, 2026 17:31
Posted by disclosure via Fulldisclosure on Sep 08TO: fulldisclosure () seclists org SUBJECT: [0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8) FROM: disclosure () 0day-rubbish com ----BODY---- 0day Rubbish…
**Subject:** CVE-2026-2035703: Tozed ZLT X300 5G CPE — Unauthenticated Remote Root Code Execution via TR-069 Command Injection (CVSS 9.8)
https://seclists.org/fulldisclosure/2026/Sep/32
Published: September 8, 2026 17:30
Posted by Surf free on Sep 08Tozed ZLT X300 5G CPE Router firmware 6.01.3 contains an OS command injection vulnerability (CWE-78) in the TR-069/CWMP client daemon (netcwmpd). The IPPingDiagnostics Host parameter is passed unsanitized into sprintf, which…
CVE-2026-52307: Stored XSS in 1CMS v5.6
https://seclists.org/fulldisclosure/2026/Sep/31
Published: September 8, 2026 17:24
Posted by 懒-癌-症～ via Fulldisclosure on Sep 08CVE-2026-52307: 1CMS v5.6 Authenticated Stored XSS Vulnerability Vulnerability Description An authenticated stored cross-site scripting (XSS) vulnerability exists in the Column Management component of ClassCMS …