Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "t.preissl via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nTitle: Multiple Integer Overflows in U-Boot Filesystem Handling\nAuthor: Timo Prei\u00dfl \u003ct.preissl () proton me\u003e\nDate: 2026-02-11\nCVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293\nAffected: Denx U-Boot \u003c= v2026.01-rc4\nFixed in: v2026.04-rc1 (commit adccdb2)\n\n== Overview ==\n\nMultiple integer overflow vulnerabilities were discovered in the U-Boot\nbootloader\u0027s filesystem handling code and command-line interface. These\nflaws can lead to heap memory under-allocation followed by heap-based\nbuffer overflows, potentially allowing Arbitrary Code Execution (ACE)\nin the pre-boot environment.\n\n== Vulnerability Details ==\n\n--- CVE-2025-70290: ZFS Metadata Integer Overflow ---\n\nComponent: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist\nImpact: A crafted ZFS filesystem image with malformed on-disk metadata\ncan trigger an integer overflow during the size calculation\npassed to calloc(), resulting in an undersized allocation and\nsubsequent out-of-bounds memory access.\nFix: Validation of allocation size using __builtin_add_overflow.\n\n--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---\n\nComponent: fs/fs.c, function do_mv\nImpact: Missing length checks in the directory move command allow an\ninteger overflow during string length addition. An attacker\nwith U-Boot shell access can trigger an under-allocation,\nresulting in a heap buffer overflow via strcpy().\nFix: Safe addition of string lengths using compiler intrinsics.\n\n--- CVE-2025-70292: SquashFS Integer Overflow ---\n\nComponent: fs/squashfs/sqfs.c, function sqfs_concat_tokens\nImpact: Manipulated token lists trigger an overflow in\nsqfs_get_tokens_length(), causing heap under-allocation\nsubsequently overflown by strcpy().\nFix: Validation of total token length before allocation.\n\n--- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow ---\n\nComponent: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable\nImpact: An integer overflow in the block group descriptor table size\ncalculation results in an undersized buffer being passed to\nmemcpy(), causing memory corruption.\nFix: Guarded multiplication of block group count and descriptor size.\n\n== Patch ==\n\nAll issues are fixed in the U-Boot master branch.\n\nCommit: adccdb2f605a6e8e046712398712398123\n\"fix integer overflows in filesystem code\"\n\nhttps://source.denx.de/u-boot/u-boot/-/commit/adccdb2\n\n== Timeline ==\n\nPatch series submitted to upstream mailing list:\nhttps://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl () proton me/T/\n\nFix merged: v2026.04-rc1\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/118"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/118"
        },
        {
          "url": "https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://source.denx.de/u-boot/u-boot/-/commit/adccdb2"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/118"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[ADVISORY] Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-70290",
              "type": "related"
            },
            {
              "destId": "CVE-2025-70293",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0379",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/118",
            "automated": true,
            "contentSha256": "ede9cdc69b26403bb25c0cce5f648fe1b21aa472692a3d9d0b0800cb28eb176c",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/118",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-27T13:30:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0379"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0379"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "t.preissl via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nTitle: Multiple Integer Overflows in U-Boot Filesystem Handling\nAuthor: Timo Prei\u00dfl \u003ct.preissl () proton me\u003e\nDate: 2026-02-11\nCVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293\nAffected: Denx U-Boot \u003c= v2026.01-rc4\nFixed in: v2026.04-rc1 (commit adccdb2)\n\n== Overview ==\n\nMultiple integer overflow vulnerabilities were discovered in the U-Boot\nbootloader\u0027s filesystem handling code and command-line interface. These\nflaws can lead to heap memory under-allocation followed by heap-based\nbuffer overflows, potentially allowing Arbitrary Code Execution (ACE)\nin the pre-boot environment.\n\n== Vulnerability Details ==\n\n--- CVE-2025-70290: ZFS Metadata Integer Overflow ---\n\nComponent: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist\nImpact: A crafted ZFS filesystem image with malformed on-disk metadata\ncan trigger an integer overflow during the size calculation\npassed to calloc(), resulting in an undersized allocation and\nsubsequent out-of-bounds memory access.\nFix: Validation of allocation size using __builtin_add_overflow.\n\n--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---\n\nComponent: fs/fs.c, function do_mv\nImpact: Missing length checks in the directory move command allow an\ninteger overflow during string length addition. An attacker\nwith U-Boot shell access can trigger an under-allocation,\nresulting in a heap buffer overflow via strcpy().\nFix: Safe addition of string lengths using compiler intrinsics.\n\n--- CVE-2025-70292: SquashFS Integer Overflow ---\n\nComponent: fs/squashfs/sqfs.c, function sqfs_concat_tokens\nImpact: Manipulated token lists trigger an overflow in\nsqfs_get_tokens_length(), causing heap under-allocation\nsubsequently overflown by strcpy().\nFix: Validation of total token length before allocation.\n\n--- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow ---\n\nComponent: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable\nImpact: An integer overflow in the block group descriptor table size\ncalculation results in an undersized buffer being passed to\nmemcpy(), causing memory corruption.\nFix: Guarded multiplication of block group count and descriptor size.\n\n== Patch ==\n\nAll issues are fixed in the U-Boot master branch.\n\nCommit: adccdb2f605a6e8e046712398712398123\n\"fix integer overflows in filesystem code\"\n\nhttps://source.denx.de/u-boot/u-boot/-/commit/adccdb2\n\n== Timeline ==\n\nPatch series submitted to upstream mailing list:\nhttps://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl () proton me/T/\n\nFix merged: v2026.04-rc1\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/119"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/119"
        },
        {
          "url": "https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://source.denx.de/u-boot/u-boot/-/commit/adccdb2"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/119"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-70290",
              "type": "related"
            },
            {
              "destId": "CVE-2025-70293",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0377",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/119",
            "automated": true,
            "contentSha256": "fbc113ddbae742d7683314d4afdd309dbb88dada1172712fb6d80816bd39b11f",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/119",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-28T15:58:35Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0377"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0377"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2026-001\nCVE ID:         CVE-2026-34473\nTitle:          Unauthenticated Denial of Service via Oversized POST Body\nin ZTE Router CGILua Parser\nAffected:       17+ ZTE ZXHN router models (~140,000 publicly exposed\ndevices)\nCVSS Score:     7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34473\n\n\nAFFECTED PRODUCTS\n-----------------\n17+ ZTE ZXHN router models sharing the CGILua firmware stack.\nEstimated 140,000+ devices publicly reachable on the Internet at time of\nresearch.\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nThe CGILua post.lua parser used in ZTE ZXHN routers does not enforce an\nupper\nbound on the body size of application/x-www-form-urlencoded POST requests.\nAn unauthenticated attacker can crash or freeze the router\u0027s web management\nservice by sending a single HTTP POST request with an oversized body to any\nCGI endpoint. No authentication, session cookie, or prior access is\nrequired.\n\n\nROOT CAUSE\n----------\nFirmware analysis of extracted squashfs images confirms that post.lua reads\nthe entire POST body into memory before parsing. There is no Content-Length\ncheck or body-size limiter before the allocation occurs. Oversized payloads\ncause the LuCI/CGILua process to exhaust memory or fault, taking down the\nweb management interface until the device is power-cycled.\n\n\nPROOF OF CONCEPT\n----------------\n  import requests\n  url = \"http://TARGET_IP/cgi-bin/luci\";\n  payload = \"a=\" + \"A\" * (256 * 1024)  # 256 KB\n  headers = {\"Content-Type\": \"application/x-www-form-urlencoded\"}\n  try:\n      r = requests.post(url, data=payload, headers=headers, timeout=15)\n      print(f\"HTTP {r.status_code}\")\n  except requests.exceptions.Timeout:\n      print(\"Timeout - DoS successful\")\n  except requests.exceptions.ConnectionError:\n      print(\"Connection dropped - DoS successful\")\n\n\nIMPACT\n------\nAn unauthenticated attacker on the LAN or WAN (if management interface is\npublicly exposed, as is the case for ~140,000 devices) can permanently\ndisable remote management access, forcing a physical reboot to restore\naccess.\nISP-deployed devices with no physical access for end users are especially\nvulnerable.\n\n\nTIMELINE\n--------\n2024-05:   Local validation on hardware. Firmware extraction and root-cause\nconfirmed.\n2024-05:   Report sent to ZTE PSIRT.\n2025-01:   Escalated to MITRE after ZTE failed to respond.\n2026-03:   MITRE assigned CVE-2026-34473.\n2026-05-20: Full public disclosure.\n\n\nVENDOR RESPONSE\n---------------\nZTE PSIRT did not respond to the initial report. MITRE assigned the CVE\ndirectly. No patch has been issued.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/18"
        },
        {
          "url": "http://TARGET_IP/cgi-bin/luci\""
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2026-34473-unauthenticated-dos-zte-routers"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34473"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/18"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2026-34473 - Unauthenticated DoS in 17+ ZTE Router Models (140K+ Devices)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34473",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0370",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/18",
            "automated": true,
            "contentSha256": "0bde7d633167526f5023053fdf061290e62adf3538e7a3b5481b6619dd73efb0",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/18",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:31:38Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0370"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0370"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2026-003\nCVE ID:         CVE-2026-34474\nTitle:          ZTE ZXHN H298A / H108N - Unauthenticated Admin Password \u0026\nWLAN Credential Exposure\nAffected:       ZTE ZXHN H298A 1.1, ZTE ZXHN H108N 2.6 (EOL; no patch\nplanned)\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34474\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nA single unauthenticated HTTP GET to /getpage.lua?pid=1000\u0026ETHCheat=1 on ZTE\nH298A or H108N routers returns the live administrator password\n(OBJ_USERINFO_IDPassword1), WLAN PSK (WLANPSK_KeyPassphrase1), and SSID in\nplaintext HTML. A second endpoint exposes the device serial number.\n\nNote: ZTE declined vendor-side assignment citing product EOL. MITRE assigned\nCVE-2026-34474 directly and published the record 2026-05-06. These devices\nremain deployed by some ISPs.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/20"
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34474"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2026-34474 - ZTE H298A/H108N Unauthenticated Admin Credential Exposure",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-34474",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0372",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/20",
            "automated": true,
            "contentSha256": "d7deed16f4c2f767f2f9e74eba7d57baf4fe782bf28eb334f544ee50fa181f82",
            "evidenceScore": 4,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:32:52Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0372"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0372"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2021-001\nCVE ID:         CVE-2021-21735\nTitle:          ZTE ZXHN H168N V3.5 - Unauthenticated Wizard Credential\nDisclosure to Full Admin Compromise\nAffected:       ZTE ZXHN H168N V3.5\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2021-21735-zte-zxhn-h168n-admin-compromise\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2021-21735\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nThe ZTE ZXHN H168N V3.5 firmware exposes quick-setup wizard endpoints that\nreturn PPPoE credentials (ADUsername, VDUsername) and the WLAN KeyPassphrase\nvia the GetPassword action without requiring authentication. The firmware\nrouting allowlists these endpoints through a QuickSetupEnable branch.\n\nIn ISP-deployed configurations where the Wi-Fi password is reused as the\ndefault admin password, this credential disclosure is a full admin\ncompromise\nchain requiring a single unauthenticated HTTP request.\n\nA bulk PoC script (zte_zxhn_h168n_bulk_poc.py) is included in the repository\nfor verifying scale of exposure.\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/21"
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2021-21735-zte-zxhn-h168n-admin-compromise"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-21735"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2021-21735 - ZTE ZXHN H168N V3.5 Unauthenticated Admin Credential Leak",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2021-21735",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0373",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/21",
            "automated": true,
            "contentSha256": "d2f8f5a013e08bcb4b6b6a60a012c74c16d028380aa5efa7266932a9a7661620",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:33:37Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0373"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0373"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.nageh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nAdvisory ID:    MONX-2026-002\nCVE ID:         CVE-2026-34472\nTitle:          ZTE ZXHN H188A V6 - Authentication Bypass via Pre-Login\nWizard Credential Leakage\nAffected:       ZTE ZXHN H188A V6.0.10P2_TE, V6.0.10P3N3_TE\nDate:           2026-05-20\nAuthor:         Mina Nageh Salalma (Monx Research)\nContact:        minanageh379 () gmail com\nPublic URL:\nhttps://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router\nMITRE:          https://www.cve.org/CVERecord?id=CVE-2026-34472\n\n\nVULNERABILITY DESCRIPTION\n--------------------------\nUnauthenticated requests to the root path of ZTE ZXHN H188A V6 firmware can\nreach pre-login wizard handlers and disclose WLAN PSKs, SSIDs, and PPPoE\nusernames. The leaked Wi-Fi password is also the default administrator\npassword after uppercasing, resulting in full authentication bypass.\n\n\nROOT CAUSE\n----------\nrouter_logic_impl.lua accepts attacker-controlled _type and _tag parameters\nfor empty-path requests. urlpath_2type_modifier.lua only activates the\nQuickSetupEnable gate when _type is absent. Supplying _type explicitly\ncauses\nthe wizard handlers (getPassword, wlan_get, ppp_get) to execute for\nunauthenticated requests, returning WLAN PSKs, SSIDs, and PPPoE credentials.\n\n\nTIMELINE\n--------\n2024-04-26: Local validation and PoC artifacts created.\n2024-05:    Report sent to ZTE PSIRT.\n2024-05-10: ZTE PSIRT stopped responding.\n2026-01-17: Escalated to MITRE.\n2026-02-02: ZTE PSIRT explicitly declined CVE assignment.\n2026-03-27: MITRE assigned CVE-2026-34472.\n2026-05-20: Full public disclosure.\n\n\nCREDITS\n-------\nMina Nageh Salalma (Monx Research)\nhttps://github.com/minanagehsalalma\n\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/19"
        },
        {
          "url": "https://github.com/minanagehsalalma"
        },
        {
          "url": "https://github.com/minanagehsalalma/cve-2026-34472-auth-bypass-zte-h188a-router"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34472"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SECURITY ADVISORY] CVE-2026-34472 - ZTE ZXHN H188A V6 Authentication Bypass via Pre-Login Wizard",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-34472",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0371",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/19",
            "automated": true,
            "contentSha256": "d8794116ee18499a7c4b69c4cb15a17272f0a479facc72de09a45ac51eca99a5",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-20T14:32:17Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0371"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0371"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adamczyk Blazej"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nMultiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\nGeneral information\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n  Multiple vulnerabilities in Sparx Pro Cloud Server (PCS) versions \u003c=\n  6.1 and Sparx Enterprise Architect versions \u003c=17.1 allow a remote\n  unauthenticated attacker to execute arbitrary sql queries (both read\n  and write) within any configured database. In case where PCS is\n  installed with WebEA the vulnerabilities allow further for remote\n  unauthenticated code execution (RCE) within the web server context.\n\n  CVSSv4 chained score: *10.0 Critical*\n  (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)\n\n\nFix\n\u2550\u2550\u2550\n\n  Currently vendor *did not resolve* any of the CVEs. The PCS\n  authentication bypass and race condition seem to be easy to implement\n  and I hope vendor will release patches soon.\n\n  As a workaround it is best to isolate the PCS instances from internet\n  and untrusted networks. Create frequent backups and review access logs\n  if possible. You could also setup a proxy to limit the PCS\n  authentication bypass (dropping requests with no or wrong model query\n  parameter.\n\n\n[Vulnerabilitiy #1] Sparx Pro Cloud Server SQL Command Execution\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42096 - Broken Access Control in Sparx Pro Cloud Server\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Pro Cloud Server versions \u003c= 6.1 build 167\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  9.4 Critical\n  (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  PCS works as a remote model for a thick client, running on user\u0027s\n  computers, called Enterprise Architect (EA). EA connects to PCS and\n  works with the exposed database by directly running SQL queries.\n  Besides user authentication (which is also vulnerable - see\n  vulnerability #2 below) there is no additional access control. Any low\n  privileged user can actually run any sql queries permitted by the\n  configured external database user. Usually the user configured is at\n  least having full access to the model database - thus any low\n  privileged user can actually destroy the whole model, retrieve and\n  change other user\u0027s password hashes and more.\n\n  The problem seems to be with legacy thick client EA architecture which\n  simply works on a database to manage all the model details.\n\n\nDetails\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  The client (EA) is connecting to the PCS HTTP server. The server might\n  require authentication *if it is properly configured* - an admin can\n  check \"Enable Security\" in EA but still not select \"Require a secure\n  and authenticated connection\" in PCS configuration what results in *NO\n  SERVER SIDE authentication at all*.\n\n  Assuming the server side authentication is required the PCS verifies\n  the authentication according to configuration - e.g. login/password,\n  Active Directory or OpenID.\n\n  Then the EA client sends request to perform SQL queries on the\n  database in an ecrypted form but the whole encryption scheme is built\n  into the client EA binary (actually downloadable from the vendor\n  webside without any authentication - as trial version). The encryption\n  is symmetric using a key contained within the binary itself thus\n  simply this is not any security measure (security by obscurity).\n\n  An attacker can obtain the key and then *create and send custom SQL\n  queries to be performed by the database*.\n\n\nPoC\n\u2500\u2500\u2500\n\n  Exploit: https://github.com/br0xpl/sparx_hack/blob/main/eacrypt.py\n  is a python script which exploits the SQL vulnerability by encrypting\n  any SQL command and sending it to the server. For security,\n  the real key is removed from the exploit code.\n\n  This script receives all users and their hashes from PCS:\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 python3 eacrypt.py http://${PCS_HOSTNAME} model \"select * from t_secuser, t_xref where t_xref.Type=\u0027User Setting\u0027 \nand t_xref.Name =\u0027SHA-256\u0027 and t_xref.Client=t_secuser.UserID\"\n  \u2514\u2500\u2500\u2500\u2500\n\n\nSolution\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  It will be hard to introduce proper authorization for all types of SQL\n  queries - this would require to rewrite the logic to use some higher\n  abstraction API which can be properly authorized.\n\n  Until a proper authorized API will be provided a quick solution could\n  be at least to verify the SQL queries executed and block the most\n  dangerous like asking about other users\u0027 passwords and so on. Maybe a\n  query whitelist with limiting the view of some critical assets like\n  hashes.\n\n  For sure it should be transparently stated in the PCS and EA\n  documentation web page. Some integrators and admins are aware of this\n  risk (there are some topics on the forum mentioning that the model\n  security is not in fact security) but this *should be well described\n  in both product documentations* as a limitation and risk which needs\n  to be understood by clients and taken into consideration at an early\n  stage while designing a production system. Otherwise it poses a high\n  risk for any company using those products.\n\n\n[Vulnerability #2] Sparx Pro Cloud Server Authentication Bypass\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42097 - Authentication Bypass in Sparx Pro Cloud Server\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Pro Cloud Server versions \u003c= 6.1 build 167\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  9.2 Critical\n  (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  An attacker can *omit PCS authentication* and e.g. combined with the\n  previous vulnerability be able to remotely execute arbitrary SQL\n  commands (read and write) *without authentication*.\n\n\nDetails\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  It seems that PCS requires authentication based on requested URL. EA\n  clients sending the encrypted SQL query to PCS are using an url which\n  looks as follows:\n\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 https://${PCS_SERVER_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}\n  \u2514\u2500\u2500\u2500\u2500\n\n  PCS seems to look at the URL and decides how to authenticate the\n  request. Unfortunately the SQL command query sends a POST request with\n  a binary blob where the model name is defined one more time and this\n  is the value that is further used by PCS to execute the query.\n\n  Thus an attacker can simply omit the model query parameter and send\n  the model name only in the binary blob in both TLS and non-TLS ports\n  and the query will be executed even thought there was no\n  authentication.\n\n\nPoC\n\u2500\u2500\u2500\n\n  To quickly verify compare the authenticated response for a request:\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 curl \u0027https://${PCS_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}\u0026apos; -X POST  -vvv --data \u0027whatever\u0027 -k\n  \u2514\u2500\u2500\u2500\u2500\n\n  which responds 401 Access Denied to response of a request without the\n  query param:\n\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 curl \u0027https://${PCS_HOSTNAME}/SparxCloudLink.sseap\u0026apos; -X POST  -vvv --data \u0027whatever\u0027 -k\n  \u2514\u2500\u2500\u2500\u2500\n\n  which responds 500 Internal Server Error.\n\n  To proof this properly use the python code which exploits the #1\n  SQL vulnerability and uses the URL without model query parameter to\n  omit the authentication.\n\n\nSolution\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Make a single parameter pointing the model (either in the blob or in\n  query param) and hook authentication and query logic on the same\n  parameter.\n\n\n[Vulnerability #3] Sparx Enterprise Architect Authorization Bypass\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42098 - Authorization Bypass in Sparx Enterprise Architect\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Enterprise Architect versions \u003c= 17.1\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  7.7 High\n  (CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Enterprise Architect software has a security feature which can\n  be enabled. When enabled the users can be limited to perform only some\n  actions by roles but this is not a real security measure as it can be\n  easily bypassed.\n\n  *Any authenticated user can actually perform any action on the model*\n  including deletion, stealing of other users\u0027 passwords and many\n  others. This *includes configurations with Pro Cloud Server* where\n  vendor advertises that PCS brings high level of security for the\n  model:\n\n        Robust security features are designed to protect sensitive\n        model information, *including role-based access control*,\n        encryption, authentication mechanisms and audit trails.\n\n        source: \u003chttps://www.sparxsystems.eu/pro-cloud-server/\u003e\n\n\nDetails\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  This vulnerability, most probably, is a result of the legacy thick\n  client architecture described in the vulnerability #1.\n\n  The EA documentation states briefly that the security is not a real\n  security:\n\n        The Security system in Enterprise Architect is designed to\n        facilitate collaboration, *not as a barrier to incursion*.\n\n        source:\n        \u003chttps://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html\u003e\n\n  but right below it suggests that model assets should be secured:\n\n        The information contained in the Repository is a valuable\n        organizational asset that needs to be maintained and\n        secured as such. The asset must be protected from both\n        *intentional* and inadvertent compromises of content. The\n        Security system allows update functions to be restricted\n        to a set of users or groups with the appropriate defined\n        permission. Packages, elements and diagrams can be locked\n        by users, preventing others from updating them.\n\n        source:\n        \u003chttps://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html\u003e\n\n  Unfortunately the current design is not protecting against intentional\n  compromises of content. An attacker can modify the EA client behavior\n  (e.g. using a debugger) to login in as any other user or administrator\n  - then it is possible to do every possible change to the repository.\n\n\nPoC\n\u2500\u2500\u2500\n\n  To show how it works it is enough to patch the binary to change the\n  logic and accept all incorrect passwords and reject correct ones. For\n  the file version 17.1.0.1714 of EA.exe (md5sum:\n  69dfe7b98d1fc156d15d8aeff726cfce) the following would patch the logic:\n\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 printf \u0027\\x84\u0027 | dd of=EA.exe bs=1 seek=$((0x34657B2)) conv=notrunc\n  \u2514\u2500\u2500\u2500\u2500\n\n  Then run the patched exe and try to login to local model with\n  different password. It also works obviously for cloud models which do\n  not require server HTTP authentication or when using the \"Login as\n  different user option\".\n\n\nSolution\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  The way security works for EA should be properly and transparently\n  presented in the EA documentation and installation notes. The sentence\n  quoted above is not enough and can be easily misinterpreted by many\n  users leading to vulnerabilities.\n\n  Also it should be explained that even when using PCS after\n  authentication there is no authorization until visibility levels are\n  enabled which are working per whole database manager not user - so in\n  fact there is no user based RBAC but rather database manager RBAC what\n  is much more coarse grained then per user roles access control.\n\n  In terms of combination of EA and PCS it is possible to secure the\n  design by e.g. following the recommendations proposed in vulnerability\n  #1.\n\n\n[Vulnerability #4] Sparx Pro Cloud Server WebEA Remote Code Execution\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42099 - Race Condition in Sparx Pro Cloud Server\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Pro Cloud Server versions \u003c= 6.1 build 167\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  9.0 Critical\n  (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  PCS configured with WebEA PHP application allows for remote command\n  execution using the /data_api/dl_internal_artifact.php endpoint. This\n  URL is used by WebEA to download content of a internal artifact. A\n  remote attacker having access to the PCS repository is able to inject\n  a malicious php file into the "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/17"
        },
        {
          "url": "http://${PCS_HOSTNAME}"
        },
        {
          "url": "https://${PCS_HOSTNAME}"
        },
        {
          "url": "https://${PCS_HOSTNAME}/SparxCloudLink.sseap\u0026apos"
        },
        {
          "url": "https://${PCS_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}\u0026apos"
        },
        {
          "url": "https://${PCS_SERVER_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}"
        },
        {
          "url": "https://${WEBEA_HOSTNAME}/data_api/dl_internal_artifact.php?guid=el_%7B8889BA10-6178-4047-9273-37FC75B0FCF6%7D\u0026modelno=1"
        },
        {
          "url": "https://${WEBEA_HOSTNAME}/data_api/poc.php\u0026apos"
        },
        {
          "url": "https://cert.pl/en/posts/2026/05/CVE-2026-42096"
        },
        {
          "url": "https://efigo.pl/"
        },
        {
          "url": "https://efigo.pl/blog/CVE-2026-42096/"
        },
        {
          "url": "https://github.com/br0xpl/sparx_hack/blob/main/eacrypt.py"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html"
        },
        {
          "url": "https://sparxsystems.com/products/procloudserver/"
        },
        {
          "url": "https://sploit.tech/"
        },
        {
          "url": "https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html"
        },
        {
          "url": "https://www.sparxsystems.eu/pro-cloud-server/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-42096",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42097",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42098",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42099",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42100",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0325",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/17",
            "automated": true,
            "contentSha256": "8bd63f8c1c70a7cdfab79e36a3fa66314cc885eb1505bb552387c93421cb47a1",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-22T10:47:33Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0325"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0325"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wade Sparks"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello Yuffie,\n\nUpon further investigation, the VulnCheck CNA determined that these\nvulnerabilities were not suitable for CVE assignment. The\nvulnerabilities exist within a SaaS product and are mitigated at the\nCSP-level which in this case, would be the vendor, EQS Group. Rather than\ncontribute unactionable CVE records, the VulnCheck CNA used its\ndiscretionary prowess to move forward with rejecting these records. This\npolicy aligns with a 2022 blog from MITRE\n\u003chttps://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID\u003e.\nIt\nshould be noted that the vendor informed us that they have published\nadvisories for the respective vulnerabilities in their \"Trust Center\"\ncustomer portal.\n\nThese actions should not be a deterrent for you to pursue CVE assignment\nthrough MITRE or another research CNA.\n\nBest regards,\n\n\u003chttps://www.vulncheck.com/\u003e\n\nWade Sparks III\nVulnCheck\nSenior Vulnerability Analyst\n\n\nOn Tue, Jan 20, 2026 at 12:13\u202fPM Yuffie Kisaragi \u003c\nyuffie.kisaragi () atomicmail io\u003e wrote:\n\n\n\nDear Art,\n\nThank you for sharing your detailed evaluation and for pointing out the\nrelevant sections of the CNA Rules.\n\nYour argument is well reasoned, particularly with respect to the current\nguidance on SaaS and exclusively hosted services.\n\nI have forwarded your evaluation to the CNA for further consideration. It\nwill also be important to understand the vendor\u2019s perspective in light of\nthe points you raised, especially regarding the applicability of the\n\u201cexclusively-hosted-service\u201d tag and the removal of prior restrictions.\n\nWe look forward to receive transparent feedback from the CNA and/or the\nvendor.\n\nTo date, the vendor has remained silent with regard to informing their\nusers about the reported issues. As far as we can determine, no public\nadvisory or user-facing communication has been issued via their\nvulnerability reporting channel (\nhttps://www.eqs.com/report-a-vulnerability/) or elsewhere.\n\nBest regards,\n\nYuffie\n\nOn Tue, Jan 20, 2026 at 7:26 PM \u003czmanion () protonmail com\u003e wrote:\n\nHi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking,\ndespite being real, independently discovered, responsibly disclosed, and\nacknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software.\nFor a period of time, there was a restriction that only the provider could\nmake or request such an assignment. But the current CVE rules remove this\nrestriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud,\non-premises, artificial intelligence, machine learning) as the sole basis\nfor determining assignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411\nand CVE-2025-34412 published and identify them as affecting an\n\"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the \u201cexclusively-hosted-service\u201d tag\nwhen all known Products listed in the CVE Record exist only as fully hosted\nservices. If the Vulnerability affects both hosted services and on-premises\nProducts, then this tag MUST NOT be used.\n\nRules: https://www.cve.org/resourcessupport/allresources/cnarules\n\nRegards,\n\n- Art\n\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/21"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        },
        {
          "url": "https://www.eqs.com/report-a-vulnerability/"
        },
        {
          "url": "https://www.vulncheck.com/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0229",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/21",
            "automated": true,
            "contentSha256": "129a3df9c6db4589d4f36748522adb23150a18cc4a4a985706b7c7951e66992c",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-21T16:29:03Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0229"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-08T07:57:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0229"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuffie Kisaragi via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dear Art,\n\n\n\n\nThank you for sharing your detailed evaluation and for pointing out the relevant\nsections of the CNA Rules.\n\n\n\n\nYour argument is well reasoned, particularly with respect to the current\nguidance on SaaS and exclusively hosted services.\n\n\n\n\nI have forwarded your evaluation to the CNA for further consideration. It will\nalso be important to understand the vendor\u2019s perspective in light of the points\nyou raised, especially regarding the applicability of the\n\u201cexclusively-hosted-service\u201d tag and the removal of prior restrictions.\n\n\n\nWe look forward to receive transparent\u00a0feedback from the CNA and/or the vendor.\n\n\nTo date, the vendor has remained silent with regard to informing their users\nabout the reported issues. As far as we can determine, no public advisory or\nuser-facing communication has been issued via their vulnerability reporting\nchannel () or elsewhere.\n\n\nBest regards,\n\n\nYuffie\n\n\nOn Tue, Jan 20, 2026 at 7:26 PM \u003c\u003e wrote:\n\nHi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking,\ndespite being real, independently discovered, responsibly disclosed, and\nacknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software. For a\nperiod of time, there was a restriction that only the provider could make or\nrequest such an assignment. But the current CVE rules remove this restriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud, on-premises,\nartificial intelligence, machine learning) as the sole basis for determining\nassignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411 and\nCVE-2025-34412 published and identify them as affecting an\n\"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the \u201cexclusively-hosted-service\u201d tag when all\nknown Products listed in the CVE Record exist only as fully hosted services.\nIf the Vulnerability affects both hosted services and on-premises Products,\nthen this tag MUST NOT be used.\n\nRules: https://www.cve.org/resourcessupport/allresources/cnarules\n\nRegards,\n\n- Art\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:42Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/26"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/26"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/26"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0213",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/26",
            "automated": true,
            "contentSha256": "16fb8f39abc59017249ab13d2d1e6c8331ea6508a7c71d74660b4fc553dabf06",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/26",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-20T17:13:27Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0213"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:42Z",
    "dateUpdated": "2026-09-08T07:57:42Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0213"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Marco Ermini via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hello everyone,\n\n\n\nKindly let me introduce myself. This is the first \u2013 and potentially, last \u2013 message on this mailing list. I am Marco, \nthe CISO of EQS Group. Kindly allow me to address some of the statements expressed publicly here.\n\n\n\nAbout the Convercent application\n\n\n\nConvercent was acquired by OneTrust in 2021, and in turn, EQS has acquired it from OneTrust at the end of 2024. Before \nbeing acquired by EQS, the Convercent application has not received much love in the latest years, and EQS has since \nthen proceeded to migrate its customers to the EQS Compliance COCKPIT, which is a modern, supported, and secure SaaS. \nThe Convercent application is sunset and will be finally switched off by mid of 2026.\n\n\n\nCurrently, Convercent is supported by EQS on a best-effort basis; despite that, EQS Group has committed to fix all \ncritical vulnerabilities until the last customer is fully migrated. We want our customers to migrate to our best \nservice because it is better \u2013 not rush them in our new product because what we inherited from an acquisition is \ninsecure.\n\n\n\n\n\nThe vulnerabilities\n\n\n\nThe two issues disclosed are either minor in nature or do not constitute vulnerabilities. One was a lack of certain \nHTTP headers (some of the reported ones where wrong, but regardless, still hardly something CVE-worthy), and the second \nwas about an \u201cexposed\u201d API; however, it is public by design as this is how the application works: it is a page where \ncustomers \u2013 who have explicitly agreed and signed off to be present \u2013 are added to a drop-down list, fed from this \npublic API. The web page exposes the list of customers by design.\n\n\n\nWhile we may reasonably question whether this page reflects current secure-by-design standards, this brings zero added \nrisk to any of the EQS customers and Convercent users.\n\n\n\nI strongly disagree with the ideas that those \u201cvulnerabilities\u201d could become CVEs \u2013 regardless of the status of the \nSaaS security and how CVEs are handled. Therefore, we proceeded to ask for their removal from the CVSS database, so not \nto alarm our customers with false positives. The responsible CNA agreed immediately to remove them (thank you very \nmuch, VulnCheck!).\n\n\n\n\n\nCommunication with our customers\n\n\n\nEQS Group communicates with its customers through established and appropriate channels \u2013 notably, our Trust Center \u2013 \nand not via anonymous mailing lists. Customers have received and will continue to receive all the notifications they \nhave contractually required to obtain, and where relevant, additional context beyond those obligations.\n\n\n\nCustomers have received a briefing about the activity happening on this mailing list via our Trust Center.\n\n\n\n\n\nThe status of SaaS Security\n\n\n\nAs EQS Group is a CNA candidate, we participate and closely follow discussions between MITRE, CISA, and the German BSI, \nabout vulnerability reporting for SaaS. While we have not heard any news on this front since the last two years, EQS \nGroup remains committed to aligning with applicable best practices as they evolve.\n\n\nWe believe that meaningful progress in SaaS security is best achieved through structured, collaborative forums with \nclear governance, rather than responding to ad-hoc reports of unvetted findings. EQS Group already participates to \nproper, professional working groups on SaaS security, for instance through the Cloud Security Alliance. If other \nworking groups will emerge through any of the official organisms already mentioned, we will certainly participate.\n\n\nIn general, as a principle, CVEs have been created many years ago, at a time where \u201cthe Cloud\u201d did not exist in its \ncurrent form. They were conceived so that users who procured a software from a development company and installed it on \ntheir system, could be notified when the software they have installed, manifested a security issue. In that way, they \ncould procure the patch and fix it before a misuse could happen.\n\n\nNow, except for very particular and edge cases, this is largely inapplicable to SaaS, where there is very little users \ncan do and solely rely on the Cloud Service Provider to fix any vulnerability. There is almost never any real ground \nfor a SaaS provider to notify a customer \u2013 unless of course a breach has been detected, but in that case we are way \nbeyond a CVE and we are on a different territory. For a SaaS, even knowing that the application had a bug, does not \nhelp the user in any way. This is why typically CVEs as a concept are not the proper tool to address SaaS \nvulnerabilities, and in general, rushing to disclose them only damages the users; a disclosure does not help them in \nany way.\n\n\n\n\nResponse to the \u201cResponsible\" Disclosure\n\n\n\nAbout the \u201cresponsible\" disclosure: EQS Group receives a significant volume of \u201cvulnerability notifications\u201d like that \none. Almost all of them are low or irrelevant issues from anonymous users looking to make a buck; they are typically \nabout a missing HTTP headers or lack of optional DNS records. Given the scale of our environment, it can happen that \nsome record is not updated, but this has little relevance to the security of our platforms. We also cannot always reply \nto all those messages, and most of them seem AI or automatically generated.\n\n\n\nThe notification from \u201cYuffie Kisaragi\u201d was sent to us on the 4th of December and went to Junk due to the low \nreputation of the email used. The author then rushed to obtain two CVE IDs less than two weeks later and subsequently \nlost no time posting them on this list.\n\n\n\nEQS Group is certainly not perfect, but if these would have been real vulnerabilities, I argue that this would have not \nqualified as a \u201cresponsible\u201d disclosure by any reasonable standard.\n\n\n\nFurther communications\n\n\nEQS Group\u2019s vulnerability handling policy is listed here\u003chttps://www.eqs.com/report-a-vulnerability/#handle\u003e \u2013  \nhttps://www.eqs.com/report-a-vulnerability/ \u2013 and we strongly suggest anyone to read it before they issue a report.\n\n\n\nIn this regard, we would like to point out the followings:\n\n  1.  For several reasons \u2013 legal, commercial, policy, and ethical \u2013 EQS Group is unable to respond to requests for \npayment of bounties outside of an official bug bounty program.\n  2.  EQS Group does nor remunerate bugs that were already discovered internally and were already in resolution.\n  3.  EQS Group strongly discourages non-approved, un-vetted testing on EQS Group\u2019s infrastructure. They can and will \nbe perceived as hostile activity. Testing is encouraged only within officially approved bug bounty programs, in respect \nto the established rules of engagement.\n  4.  Kindly avoid pointless reports on MTA-STS records, DMARC, quantum ciphers, and other junk like that. It makes our \nlife easier.\n\n\n\nThank you for your attention.\n\nBest regards / mit freundlichen Gr\u00fc\u00dfen / Cordiali saluti\n\nDr Marco Ermini (He/Him)\nChief Information Security Officer (CISO)\n\nMarco.Ermini () eqs com\u003cmailto:Marco.Ermini () eqs com;\u003e\n\n[LinkendIn]\u003chttps://www.linkedin.com/in/marcoermini/\u003e\nVereinbaren Sie einen Termin mit mir\u003chttps://outlook.office365.com/owa/calendar/BookaMeetingwithMarco () eqs \ncom/bookings/\u003e\n[EQS Group Logo]\u003chttps://www.eqs.com/?keyword=email-footer\u003e\n\n[EQS Compliance COCKPIT]\u003chttps://www.eqs.com/de/platform-compliance-ethics/?keyword=email-footer\u003e\nEQS Group GmbH | Karlstr. 47 | 80333 M\u00fcnchen | www.eqs.com\u003chttps://www.eqs.com/?keyword=email-footer\u003e | \nwww.integrityline.com\u003chttp://www.integrityline.com/?keyword=email-footer\u003e\n[linkedIn Logo]\u003chttps://www.linkedin.com/company/1273779\u003e\n[X Logo]\u003chttps://twitter.com/eqsgroup\u003e\n[Instagram Logo]\u003chttps://www.instagram.com/eqsgroup/\u003e\n[YouTube Logo]\u003chttps://www.youtube.com/user/EquityStory\u003e\n[RSS Logo]\u003chttps://www.eqs.com/compliance-knowledge/\u003e\n[Xing Logo]\u003chttps://www.xing.com/companies/eqsgroup\u003e\nRegister Court: Munich | Register Number: HRB 297048\nManaging Directors: Achim Weick (CEO), Andr\u00e9 Silverio Marques, Marcus Sultzer\n\nThe preceding email message contains information that is confidential and may constitute non-public information that is \nintended to be conveyed only to the designated recipient(s).\nIf you are not an intended recipient of this message, please notify the sender at +49 89 444430-000\u003ctel:+4989444430000\u003e.\nUnauthorized use, dissemination, distribution, or reproduction of this message is strictly prohibited and may be \nunlawful.\n\n\nFrom: Wade Sparks \u003cwsparks () vulncheck com\u003e\nDate: Wednesday, 21. January 2026 at 17:29\nTo: Yuffie Kisaragi \u003cyuffie.kisaragi () atomicmail io\u003e\nCc: Security Vulnerability \u003csecurity-vulnerability () eqs com\u003e, fulldisclosure () seclists org \u003cfulldisclosure () \nseclists org\u003e\nSubject: Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing \nPlatform (EQS Group)\n\n\nEXTERNAL EMAIL WARNING: Please check the sender of the message\n\nHello Yuffie,\n\nUpon further investigation, the VulnCheck CNA determined that these vulnerabilities were not suitable for CVE \nassignment. The vulnerabilities exist within a SaaS product and are mitigated at the CSP-level which in this case, \nwould be the vendor, EQS Group. Rather than contribute unactionable CVE records, the VulnCheck CNA used its \ndiscretionary prowess to move forward with rejecting these records. This policy aligns with a 2022 blog from \nMITRE\u003chttps://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID\u003e. It should be noted that the \nvendor informed us that they have published advisories for the respective vulnerabilities in their \"Trust Center\" \ncustomer portal.\n\nThese actions should not be a deterrent for you to pursue CVE assignment through MITRE or another research CNA.\n\nBest regards,\n\n[https://lh7-us.googleusercontent.com/-9dCGnQIZaW0ehyK1B0bqLmef7d7ZWuSmmmWUYJGhzNgtzRhqFPZrtO3AnQt8PETFHiv6_YST3DacZVgrxPdAYXErAMnJrF6Isn27caszruLjby7jLRuuU__5emkqFjU8hczQ307--yVVMpVSiK7Qg]\u003chttps://www.vulncheck.com/\u003e\n\nWade Sparks III\n\nVulnCheck\nSenior Vulnerability Analyst\n\n\nOn Tue, Jan 20, 2026 at 12:13\u202fPM Yuffie Kisaragi \u003cyuffie.kisaragi () atomicmail io\u003cmailto:yuffie.kisaragi () atomicmail \nio\u003e\u003e wrote:\n\n\nDear Art,\n\n\nThank you for sharing your detailed evaluation and for pointing out the relevant sections of the CNA Rules.\n\n\nYour argument is well reasoned, particularly with respect to the current guidance on SaaS and exclusively hosted \nservices.\n\n\nI have forwarded your evaluation to the CNA for further consideration. It will also be important to understand the \nvendor\u2019s perspective in light of the points you raised, especially regarding the applicability of the \n\u201cexclusively-hosted-service\u201d tag and the removal of prior restrictions.\n\nWe look forward to receive transparent feedback from the CNA and/or the vendor.\n\nTo date, the vendor has remained silent with regard to informing their users about the reported issues. As far as we \ncan determine, no public advisory or user-facing communication has been issued via their vulnerability reporting \nchannel (https://www.eqs.com/report-a-vulnerability/) or elsewhere.\n\nBest regards,\n\nYuffie\n\nOn Tue, Jan 20, 2026 at 7:26 PM \u003czmanion () protonmail com\u003cmailto:zmanion () protonmail com\u003e\u003e wrote:\n\nHi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking, despite being real, independently discovered, \nresponsibly disclosed, and acknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software. For a period of time, there was a restriction \nthat only the provider could make or request such an assignment. But the current CVE rules remove this restriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud, on-premises, artificial intelligence, machine \nlearning) as the sole basis for determining assignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411 and CVE-2025-34412 published and identify them \nas affecting an \"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the \u201cexclusively-hosted-service\u201d tag when all known Products listed in the CVE Record \nexist only as fully"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/25"
        },
        {
          "url": "http://www.integrityline.com/?keyword=email-footer"
        },
        {
          "url": "https://lh7-us.googleusercontent.com/-9dCGnQIZaW0ehyK1B0bqLmef7d7ZWuSmmmWUYJGhzNgtzRhqFPZrtO3AnQt8PETFHiv6_YST3DacZVgrxPdAYXErAMnJrF6Isn27caszruLjby7jLRuuU__5emkqFjU8hczQ307--yVVMpVSiK7Qg"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://outlook.office365.com/owa/calendar/BookaMeetingwithMarco"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://twitter.com/eqsgroup"
        },
        {
          "url": "https://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        },
        {
          "url": "https://www.eqs.com/?keyword=email-footer"
        },
        {
          "url": "https://www.eqs.com/compliance-knowledge/"
        },
        {
          "url": "https://www.eqs.com/de/platform-compliance-ethics/?keyword=email-footer"
        },
        {
          "url": "https://www.eqs.com/report-a-vulnerability/"
        },
        {
          "url": "https://www.eqs.com/report-a-vulnerability/#handle"
        },
        {
          "url": "https://www.instagram.com/eqsgroup/"
        },
        {
          "url": "https://www.linkedin.com/company/1273779"
        },
        {
          "url": "https://www.linkedin.com/in/marcoermini/"
        },
        {
          "url": "https://www.vulncheck.com/"
        },
        {
          "url": "https://www.xing.com/companies/eqsgroup"
        },
        {
          "url": "https://www.youtube.com/user/EquityStory"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0185",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/25",
            "automated": true,
            "contentSha256": "5706daeae34135987f816ff9f75eb733cc5a660d5099b81280a650892732ead3",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-23T18:41:47Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0185"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0185"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuffie Kisaragi via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "UPDATE:\n\n\n\n\nFollowing the publication of these vulnerabilities and the subsequent CVE\nassignments, the CVE identifiers have now been revoked.\n\n\n\n\nThe vendor (EQS Group) contacted the CVE Program (via a CNA) and\u00a0disputed the\nrecords, stating that the affected product is an exclusively hosted SaaS\nplatform with no customer-managed deployment or versioning. Based on this\nargument, the CVE Program concluded that CVE assignment is \u201cnot a suitable\nsolution for vulnerability identification\u201d in this case, as customers do not\ntake direct action to apply fixes.\n\n\n\n\nIn other words, because the service is centrally hosted and patched at the\nprovider\u2019s discretion, the vulnerabilities are no longer considered eligible for\nCVE tracking, despite being real, independently discovered, responsibly\ndisclosed, and acknowledged by the vendor.\n\nThe vendor has stated that fixes are being implemented and that private customer\nnotifications will be issued internally.\n\n\n\n\nWhile remediation is of course welcome, this outcome highlights a broader issue:\nvulnerabilities in SaaS platforms can effectively disappear from public\nvulnerability tracking, simply because the deployment model removes user agency,\na model that arguably incentivizes security through obscurity, rather than\ntransparency.\n\n\n\n\nThe technical findings remain valid.\n\n\n\n\nThis update is shared purely for accuracy and record-keeping.\n\nOn Sun, Jan 4, 2026 at 4:40 PM \u003cyuffie.kisaragi () atomicmail io\n[yuffie.kisaragi () atomicmail io]\u003e wrote:\nUPDATE:\n\n\nThe reported vulnerabilities have now been assigned CVE identifiers:\nCVE-2025-34411: https://www.cve.org/cverecord?id=CVE-2025-34411\n[https://www.cve.org/cverecord?id=CVE-2025-34411]\nCVE-2025-34412: https://www.cve.org/cverecord?id=CVE-2025-34412\n[https://www.cve.org/cverecord?id=CVE-2025-34412]\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/4"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/cverecord?id=CVE-2025-34411"
        },
        {
          "url": "https://www.cve.org/cverecord?id=CVE-2025-34412"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0195",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/4",
            "automated": true,
            "contentSha256": "f09c92da4c5a7aeb2581a72015cc49071ab139218b207121c182b6d3bc9d070c",
            "evidenceScore": 4,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-04T22:01:57Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0195"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0195"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Art Manion via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hi,\n\nthe vulnerabilities are no longer considered eligible for CVE tracking, despite being real, independently discovered, \nresponsibly disclosed, and acknowledged by the vendor.\nCVE IDs *can* be assigned for SaaS or similarly \"cloud only\" software.  For a period of time, there was a restriction \nthat only the provider could make or request such an assignment.  But the current CVE rules remove this restriction:\n\n4.2.3 CNAs MUST NOT consider the type of technology (e.g., cloud, on-premises, artificial intelligence, machine \nlearning) as the sole basis for determining assignment.\n\nIt would have been acceptable (even preferred) to leave CVE-2025-34411 and CVE-2025-34412 published and identify them \nas affecting an \"exclusively-hosted-service:\"\n\n5.1.11.1 (A CVE Record) MUST use the \u201cexclusively-hosted-service\u201d tag when all known Products listed in the CVE Record \nexist only as fully hosted services. If the Vulnerability affects both hosted services and on-premises Products, then \nthis tag MUST NOT be used.\n\nRules: https://www.cve.org/resourcessupport/allresources/cnarules\n\nRegards,\n\n - Art\n\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/17"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/resourcessupport/allresources/cnarules"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Re: Multiple Security Misconfigurations and Customer Enumeration Exposure in Convercent Whistleblowing Platform (EQS Group)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-34411",
              "type": "related"
            },
            {
              "destId": "CVE-2025-34412",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0197",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/17",
            "automated": true,
            "contentSha256": "d187d28957b37a8564bdb303fce20e7735192773826c8c243907db2920484f09",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-08T18:26:44Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0197"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-08T07:57:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0197"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-53899",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T21:42:27.212367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T21:42:35.190Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unknown",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "Unknown"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:podcastgenerator:podcast_generator:3.2.9:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mirabbas A\u011falarov"
        }
      ],
      "datePublic": "2023-07-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the \u0027shortdesc\u0027 parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.\u003c/p\u003e"
            }
          ],
          "value": "PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the \u0027shortdesc\u0027 parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:47:38.887Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "ExploitDB-51565",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/51565"
        },
        {
          "name": "Podcast Generator Product Homepage",
          "tags": [
            "product"
          ],
          "url": "https://podcastgenerator.net/"
        },
        {
          "name": "Podcast Generator GitHub Repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/PodcastGenerator/PodcastGenerator"
        },
        {
          "name": "VulnCheck Advisory: PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/podcastgenerator-blind-server-side-request-forgery-via-xml-injection"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2023-53899",
    "datePublished": "2025-12-16T17:03:47.087Z",
    "dateReserved": "2025-12-16T00:10:40.314Z",
    "dateUpdated": "2026-07-28T01:47:38.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-53899",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T21:42:27.212367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T21:42:35.190Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Unknown",
          "vendor": "Unknown",
          "versions": [
            {
              "status": "affected",
              "version": "Unknown"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:podcastgenerator:podcast_generator:3.2.9:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mirabbas A\u011falarov"
        }
      ],
      "datePublic": "2023-07-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the \u0027shortdesc\u0027 parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.\u003c/p\u003e"
            }
          ],
          "value": "PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the \u0027shortdesc\u0027 parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:47:38.887Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "ExploitDB-51565",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/51565"
        },
        {
          "name": "Podcast Generator Product Homepage",
          "tags": [
            "product"
          ],
          "url": "https://podcastgenerator.net/"
        },
        {
          "name": "Podcast Generator GitHub Repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/PodcastGenerator/PodcastGenerator"
        },
        {
          "name": "VulnCheck Advisory: PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/podcastgenerator-blind-server-side-request-forgery-via-xml-injection"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2023-53899",
    "datePublished": "2025-12-16T17:03:47.087Z",
    "dateReserved": "2025-12-16T00:10:40.314Z",
    "dateUpdated": "2026-07-28T01:47:38.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}