March 2026 (30)
PhreeBooks ERP 5.2.3 Remote Code Execution Vulnerability
2 rules 3 TTPsPhreeBooks ERP 5.2.3 is vulnerable to remote code execution, allowing authenticated attackers to upload and execute arbitrary PHP files via the image manager, leading to reverse shell connections and system command execution.
Bootstrapy CMS Unauthenticated SQL Injection Vulnerabilities
3 rules 1 TTPBootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters to extract sensitive database information or cause denial of service.
eNdonesia Portal v8.7 SQL Injection Vulnerability
2 rules 1 TTPeNdonesia Portal v8.7 is vulnerable to SQL injection allowing unauthenticated attackers to execute arbitrary SQL queries via the bid parameter in banners.php, potentially leading to sensitive data extraction.
Netartmedia Vlog System SQL Injection Vulnerability
2 rules 1 TTP 1 IOCNetartmedia Vlog System is vulnerable to SQL injection, allowing unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter in the forgotten_password module.
Inout Article Base CMS SQL Injection Vulnerability (CVE-2019-25640)
2 rules 1 TTPInout Article Base CMS is vulnerable to SQL injection, allowing unauthenticated attackers to manipulate database queries through the 'p' and 'u' parameters via XOR-based payloads in GET requests to portalLogin.php, potentially leading to sensitive information extraction or denial-of-service.
Base64 Decoder 1.1.2 Stack-Based Buffer Overflow (CVE-2019-25634)
2 rules 2 TTPsBase64 Decoder 1.1.2 is vulnerable to a stack-based buffer overflow (CVE-2019-25634) allowing local attackers to achieve arbitrary code execution via a crafted input file that triggers an SEH overwrite.
Meeplace Business Review Script SQL Injection Vulnerability (CVE-2019-25638)
2 rules 1 TTPMeeplace Business Review Script is vulnerable to SQL injection via the 'id' parameter in the addclick.php endpoint, allowing unauthenticated attackers to execute arbitrary SQL queries and potentially extract sensitive database information or cause a denial of service.
X-NetStat Pro 5.63 Local Buffer Overflow Vulnerability
2 rules 1 TTPX-NetStat Pro 5.63 contains a local buffer overflow vulnerability (CVE-2019-25637) allowing local attackers to execute arbitrary code by overwriting the EIP register.
Zeeways Jobsite CMS SQL Injection Vulnerability (CVE-2019-25636)
2 rules 1 TTPZeeways Jobsite CMS is vulnerable to SQL injection, allowing unauthenticated attackers to inject SQL code through the 'id' GET parameter in crafted requests to news_details.php, jobs_details.php, or job_cmp_details.php to extract sensitive database information.
Zeeways Matrimony CMS Unauthenticated SQL Injection Vulnerability
2 rules 1 TTP 1 IOCZeeways Matrimony CMS is vulnerable to SQL injection via the profile_list endpoint, where an unauthenticated attacker can inject SQL code via the up_cast, s_mother, and s_religion parameters, potentially allowing them to extract sensitive information.
AIDA64 Business SEH Buffer Overflow Vulnerability (CVE-2019-25631)
2 rules 3 TTPsAIDA64 Business 5.99.4900 is vulnerable to a local Structured Exception Handling (SEH) buffer overflow (CVE-2019-25631) allowing attackers to execute arbitrary code by overwriting SEH pointers with malicious shellcode.
PhreeBooks ERP 5.2.3 Arbitrary File Upload Vulnerability
2 rules 2 TTPsPhreeBooks ERP 5.2.3 is vulnerable to arbitrary file upload in the Image Manager component, allowing authenticated attackers to upload malicious PHP files leading to remote code execution.
AIDA64 Extreme 5.99.4900 Structured Exception Handler Buffer Overflow
2 rules 1 TTP 1 IOCAIDA64 Extreme 5.99.4900 is vulnerable to a structured exception handler buffer overflow, allowing local attackers to execute arbitrary code by supplying a malicious CSV log file path through the Hardware Monitoring logging preferences.
Download Accelerator Plus (DAP) SEH Buffer Overflow Vulnerability
2 rules 1 TTP 2 IOCsDownload Accelerator Plus DAP 10.0.6.0 is vulnerable to a structured exception handler buffer overflow, allowing remote attackers to execute arbitrary code via malicious crafted URLs by overwriting SEH pointers and executing embedded shellcode.
FlexHEX 2.71 Local Buffer Overflow Vulnerability (CVE-2019-25627)
2 rules 2 TTPsFlexHEX 2.71 is vulnerable to a local buffer overflow in the Stream Name field, allowing local attackers to execute arbitrary code via a structured exception handler (SEH) overflow.
Compromised Litellm PyPI Package Versions
2 rules 4 TTPs 1 IOCVersions 1.82.7 and 1.82.8 of the Litellm package on PyPI were compromised in a supply chain attack, potentially impacting numerous users, with recommendations to avoid updating to these versions.
Multiple Vulnerabilities in cPanel/WHM
2 rules 2 TTPsAn anonymous remote attacker can exploit multiple vulnerabilities in cPanel/WHM to bypass security measures, perform XSS and SSRF attacks, disclose information, and potentially execute code.
JetAudio jetCast Server 2.0 Stack-Based Buffer Overflow
2 rules 2 TTPs 1 IOCJetAudio jetCast Server 2.0 is vulnerable to a stack-based buffer overflow in the Log Directory configuration, enabling local attackers to overwrite structured exception handling pointers and execute arbitrary code.
Lucky Pasta Shellcode Loader for Windows
2 rules 3 TTPs 2 IOCsA shellcode loader dubbed 'Lucky Pasta' employs JIT decryption, string obfuscation, dynamic library loading, fiber-based execution, and AES instruction patching to evade AV detection, retrieving shellcode via HTTP/HTTPS and executing it on Windows systems.
MacCMS 2025.1000.4052 Missing Authentication Vulnerability (CVE-2026-4562)
2 rules 1 TTPA missing authentication vulnerability exists in MacCMS 2025.1000.4052, specifically affecting the Timming API Endpoint component in application/api/controller/Timming.php, allowing remote attackers to bypass authentication.
OpenClaw Improper Header Validation Leads to Credential Leakage
2 rules 1 TTPOpenClaw before 2026.3.7 is vulnerable to improper header validation in fetchWithSsrFGuard, allowing attackers to intercept sensitive authorization headers via cross-origin redirects.
Oracle Fusion Middleware RCE Vulnerability (CVE-2026-21992)
2 rules 2 TTPsCVE-2026-21992 allows an unauthenticated attacker to gain network access via HTTP and execute code remotely on Oracle Identity Manager and Oracle Web Services Manager.
OwnTone Server DAAP Request NULL Pointer Dereference Denial-of-Service (CVE-2026-26828)
2 rules 2 TTPsA NULL pointer dereference vulnerability in the daap_reply_playlists function of owntone-server allows attackers to cause a Denial of Service (DoS) by sending a crafted DAAP request.
ReviewX WordPress Plugin Arbitrary Method Call Vulnerability
2 rules 1 TTPThe ReviewX WordPress plugin is vulnerable to arbitrary method calls, allowing unauthenticated attackers to potentially achieve remote code execution.
SourceCodester Online Library Management System SQL Injection Vulnerability (CVE-2026-4624)
2 rules 1 TTPA remote SQL injection vulnerability (CVE-2026-4624) exists in SourceCodester Online Library Management System 1.0 by manipulating the 'searchField' parameter in the /home.php file, potentially allowing attackers to execute arbitrary SQL commands.
strongSwan EAP-TTLS AVP Integer Underflow Vulnerability (CVE-2026-25075)
2 rules 1 TTPAn integer underflow vulnerability in strongSwan's EAP-TTLS AVP parser allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication, leading to excessive memory allocation or a NULL pointer dereference.
TOTOLINK X6000R Remote Command Injection Vulnerability
2 rules 1 TTPA remote command injection vulnerability exists in TOTOLINK X6000R routers, specifically versions 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826, allowing attackers to execute arbitrary commands via manipulation of the Hostname argument in the setLanCfg function.
Unauthenticated CLI Escape Vulnerability (CVE-2026-3587)
2 rules 2 TTPsAn unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface of a device, leading to full compromise and root access on the underlying Linux-based OS, as described in CVE-2026-3587.
WP Job Portal Plugin SQL Injection Vulnerability
2 rules 1 TTPThe WP Job Portal plugin for WordPress is vulnerable to SQL Injection via the 'radius' parameter, allowing unauthenticated attackers to extract sensitive database information in versions up to 2.4.8.
WWBN AVideo Unauthenticated decryptString Vulnerability
2 rules 1 TTPWWBN AVideo, up to version 26.0, contains an improper authentication vulnerability (CVE-2026-33512) in the API plugin's `decryptString` action, allowing unauthenticated users to decrypt publicly accessible ciphertext and potentially recover protected tokens/metadata.