Threat briefs

getID3 versions prior to 1.9.26 are vulnerable to OS command injection via unescaped shell metacharacters in filenames, allowing for arbitrary command execution.

A critical command injection vulnerability in the D-Link R95 BE9500 firmware (1.00.16) allows remote attackers to execute arbitrary OS commands via the DHMAPI component.

NivoCart versions 2.4.0 and earlier are vulnerable to remote code execution via an arbitrary file upload flaw in the File Manager multi() endpoint.

DedeCMS versions up to 5.7.118 contain a code injection vulnerability in the plus/mytag_js.php file that allows unauthenticated remote attackers to execute arbitrary code via the aid argument.

Internship Management System version 1.0 is vulnerable to unauthenticated remote SQL injection via the Password parameter in login.php, for which public exploit code is available.

A stack-based buffer overflow vulnerability in the Comfast CF-N1-S Web Management Interface (CVE-2026-94003) allows remote, unauthenticated attackers to execute arbitrary code via a malicious URI request.

SourceCodester Online Reviewer Management System 1.0 is vulnerable to remote SQL injection via the 'Course' parameter, allowing unauthenticated attackers to manipulate database queries.

SxDevOps versions 1.0 and 1.1 contain a hard-coded credential vulnerability in the ensure_default_superuser function, allowing remote attackers to bypass authentication and gain unauthorized access.

Webhood versions 0.9.0 and earlier contain a critical authentication bypass vulnerability (CVE-2024-31218) allowing unauthenticated attackers to create an administrative account via the PocketBase API.

A heap-based buffer overflow vulnerability in the Kamailio CDP Diameter Receiver module (CVE-2026-93962) allows unauthenticated remote attackers to achieve potential code execution or denial of service.

The Expat library through version 2.8.4 incorrectly validates UTF-16 surrogate pairs, allowing attackers to perform XML injection via malformed input that obscures markup characters.

Gopeed through version 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows an attacker to write arbitrary files outside the designated directory when the AutoExtract feature is enabled.

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows allowing unauthorized access to workflow metadata via crafted namespace field selectors.

The Mstore Api plugin for WordPress (<= 4.20.0) is vulnerable to authentication bypass via JWT forgery, allowing unauthenticated attackers to impersonate any user by crafting illegitimate Firebase Phone Auth tokens.

The Forminator plugin for WordPress contains an arbitrary shortcode execution vulnerability (CVE-2026-92229) allowing unauthenticated attackers to execute arbitrary shortcodes by leveraging improper input validation.

The WP Recipe Maker plugin for WordPress (<= 10.8.1) is vulnerable to arbitrary shortcode execution due to recursive do_shortcode calls on user-supplied metadata fields.

The Gravity Forms WordPress plugin (<= 3.1.0.4) is susceptible to unauthenticated remote code execution due to a validation flaw in the upload_file function allowing hidden file upload fields to bypass extension checks.

Multiple methods in the CakePHP FunctionsBuilder component are vulnerable to SQL injection when user-supplied input is passed to specific functional parameters.

The CakePHP framework contains an SQL injection vulnerability in the FunctionsBuilder::jsonValue() method when using the Postgres driver, allowing unauthorized database command execution via user-controlled jsonPath input.

An unauthenticated arbitrary file deletion vulnerability in the Frontend Admin plugin for WordPress allows attackers to delete critical server files, potentially leading to remote code execution.

An unauthenticated stored XSS vulnerability in Concrete CMS Community Store versions prior to 2.7.8 allows attackers to execute malicious scripts in manager sessions via order fields.

A sandbox escape vulnerability in the OpenPanel js-runtime allows authenticated users with project write access to achieve arbitrary code execution via the webhook template validator.

Detection of reconnaissance activity where AWS users or roles query the EC2 API for deprecated Amazon Machine Images, a technique used by adversaries to identify vulnerable or outdated system images for potential exploitation.

Unauthorized importation or deployment of AI models in AWS Bedrock can facilitate a supply-chain compromise by introducing backdoored or poisoned artifacts into an organization's inference pipeline.

Adversaries may attempt to retrieve EC2 administrator passwords via the GetPasswordData API to facilitate privilege escalation or lateral movement within AWS environments.

This brief describes a method for detecting Adversary-in-the-Middle (AiTM) phishing and session theft in AWS environments by identifying IAM user console logins originating from geographically distinct locations within a short timeframe.

Adversaries leverage S3 CopyObject API calls to encrypt data within victim buckets using external, attacker-controlled KMS keys, effectively denying access to the bucket owner.

Adversaries may disable MFA Delete on versioned Amazon S3 buckets to enable the permanent destruction of object version history, a critical step in ransomware attacks targeting cloud-native backups.

Adversaries may disable or schedule the deletion of AWS KMS keys to sabotage business operations, render encrypted data unrecoverable, and obstruct forensic investigation or incident response efforts.

Adversaries may modify Amazon S3 bucket policies to include a wildcard ('*') principal with 'Allow' permissions, effectively making bucket contents publicly accessible for data exfiltration.