Tag
Sunnet CTMS/CPAS Arbitrary File Upload Vulnerability (CVE-2026-7490)
2 rules 3 TTPs 1 CVEA privileged remote attacker can exploit CVE-2026-7490 in Sunnet CTMS and CPAS to upload and execute web shell backdoors, leading to arbitrary code execution on the server.
Borg SPM 2007 Arbitrary File Upload Vulnerability (CVE-2026-6885)
2 rules 1 TTP 1 CVEAn unauthenticated remote attacker can exploit an arbitrary file upload vulnerability (CVE-2026-6885) in Borg SPM 2007 to upload and execute web shell backdoors, leading to arbitrary code execution on the server.
FlowiseAI File Upload Validation Bypass Leads to RCE
2 rules 2 TTPs 1 CVEA file upload validation bypass vulnerability exists in FlowiseAI, where the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type, enabling an attacker to upload .js files, store malicious Node.js web shells on the server, and potentially achieve Remote Code Execution (RCE).
Potential Web Shell ASPX File Creation
2 rules 1 TTPThe creation of ASPX files in web server directories, excluding legitimate processes, indicates potential web shell deployment for persistence on Windows systems.
Uncommon Destination Port Connection by Web Server on Linux
2 rules 4 TTPsThe rule identifies unusual outbound network connections on non-standard ports originating from web server processes on Linux systems, indicative of potential web shell activity or unauthorized communication.