{"vulnerability": "CVE-2026-5785", "sightings": [{"uuid": "708dfb45-7c17-44f2-8f2b-40714732dd96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5785", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjmvb2imvo2p", "content": "", "creation_timestamp": "2026-04-16T17:03:01.496879Z"}, {"uuid": "d2b1c577-fc9b-40c5-9e80-846f80d06f6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5785", "type": "seen", "source": "Telegram/5D912vOHN-G66auq1Hho6ww_p26h6YJ5ZFpozWyyt1z6weM", "content": "", "creation_timestamp": "2026-04-16T15:19:53.000000Z"}, {"uuid": "b7e8f7b9-ad44-4cc1-a7d2-e6eebe3b9993", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57851", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq3ei5ibfe2w", "content": "CVE-2026-57851 - MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers\nCVE ID : CVE-2026-57851\n \n Published : July 7, 2026, 5:16 p.m. | 1\u00a0hour, 58\u00a0minutes ago\n \n Description : MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64....", "creation_timestamp": "2026-07-07T19:43:51.573471Z"}, {"uuid": "fdb8254f-64d8-45d3-b97a-33395b3149a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57850", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqd26b42is2l", "content": "\ud83d\udfe0 CVE-2026-57850 - High (8.3)\n\nRustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-57850/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-10T21:00:40.854355Z"}, {"uuid": "ea353da2-19aa-4549-a3a4-80d4c371d105", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57851", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdekowce22s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-57851 \u0432 MSI Feature Manager: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/7CA4E73B-77D4-47D4-9931-87C211E7FB1C", "creation_timestamp": "2026-07-11T00:06:34.713249Z"}, {"uuid": "9f1ec357-4d43-465d-852e-adb9f2d6da19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57850", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdlp4gial27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-57850 \u0432 RustDesk: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/1296EBD1-2243-4E72-9AC5-4F50A71E7437", "creation_timestamp": "2026-07-11T02:14:19.904161Z"}, {"uuid": "a17d965f-377d-422d-bf26-6bd7ea62cdc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57855", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mql6pslbe62e", "content": "CVE-2026-57855 - Cockpit CMS Missing Authorization in Bucket File Storage API\nCVE ID : CVE-2026-57855\n \n Published : July 13, 2026, 11:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/...", "creation_timestamp": "2026-07-14T02:43:21.925032Z"}, {"uuid": "5942ca65-9056-4dfd-99da-3add549cb90f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57856", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mql6yqzdqc2k", "content": "CVE-2026-57856 - Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API\nCVE ID : CVE-2026-57856\n \n Published : July 13, 2026, 11:16 p.m. | 1\u00a0hour, 17\u00a0minutes ago\n \n Description : Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API ...", "creation_timestamp": "2026-07-14T02:48:22.259571Z"}, {"uuid": "a5e7808f-d578-49ee-b3c3-988624d09273", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57857", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqxhjjuvhu2a", "content": "CVE-2026-57857 - Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter\nCVE ID : CVE-2026-57857\n \n Published : July 18, 2026, 9:17 p.m. | 2\u00a0hours, 23\u00a0minutes ago\n \n Description : The Flow Payment plugin for WordPress (flow.cl) version 3.0....", "creation_timestamp": "2026-07-18T23:52:51.911102Z"}, {"uuid": "61a4d90d-5ed2-4146-a81d-58473b8c4721", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57859", "type": "seen", "source": "https://gist.github.com/sermikr0/6f68b5bcfc1024269f1cd032abb55a0f", "content": "# CVE-2026-57859 \u2014 e107 CMS: Second-Order Persistent RCE via `eval()` in Legacy `user_prefs` Deserialization\n\n**Severity:** HIGH (CVSS 8.1)  \n**CWE:** CWE-94 \u2014 Code Injection  \n**Affected:** e107 CMS v2.3.x (all current versions)  \n**Status:** \u26a0\ufe0f Unpatched \u2014 Vendor notified via VulnCheck CVD (2026-07-17)  \n**CVE ID:** CVE-2026-57859 (allocated by VulnCheck)\n\n---\n\n## Summary\n\ne107's `e107::unserialize()` function contains a legacy deserialization path in `e107_handlers/core_functions.php` that passes database-stored content directly into PHP's `eval()`. Any value in the `user_prefs` database column that begins with the string `array` is evaluated as PHP code on every user login. An attacker who can write to `user_prefs` (via SQL injection, IDOR, or direct DB access in a multi-tenant scenario) achieves persistent Remote Code Execution without writing a PHP file.\n\n---\n\n## Vulnerable Code\n\n**File:** `e107_handlers/core_functions.php` \u2014 lines 651\u2013657\n\n```php\n$ArrayData = trim($ArrayData);\n\n// Only guard: value must begin with 'array' (case-insensitive)\nif (stripos($ArrayData, 'array') !== 0) {\n    return false;\n}\n\n// Vulnerable: user-controlled $ArrayData passed directly to eval()\n$ArrayData = '$data = ' . $ArrayData . ';';\ntry {\n    @eval($ArrayData);   // \u2190 SINK: arbitrary PHP code execution\n} catch (ParseError $e) {\n    ...\n}\n```\n\nThe guard `stripos($ArrayData, 'array') !== 0` only checks that the value **starts with** `array`. Any PHP expression valid as an array element \u2014 including function calls like `system()`, `passthru()`, `file_put_contents()` \u2014 passes this check.\n\n---\n\n## Call Chain (Triggered on Login)\n\n```\nHTTP POST /e107_web/index.php (login request)\n  \u2514\u2500 e107_handlers/login.php:472\n       \u2514\u2500 e107::getArrayStorage()->unserialize($userData['user_prefs'])\n            \u2514\u2500 e107_handlers/core_functions.php:651 \u2014 legacy branch\n                 \u2514\u2500 @eval('$data = ' . $user_prefs . ';')\n                      \u2514\u2500 ARBITRARY CODE EXECUTES as web server user\n```\n\nThe payload is **persistent**: once stored in `user_prefs`, it executes on **every subsequent login** for that user account.\n\n---\n\n## Attack Scenario\n\n**Prerequisite:** Write access to the `user_prefs` column (via SQL injection elsewhere in e107, IDOR, or admin-level access in a compromised environment).\n\n**Payload stored in `user_prefs`:**\n```\narray(0 => system('id'))\n```\n\n**What eval() executes:**\n```php\n$data = array(0 => system('id'));\n```\n\n**Result:** `system('id')` executes server-side, returning `uid=33(www-data)`.\n\n**Why this is second-order:** The payload is written to the database in one request and triggered on a later, unrelated login request \u2014 bypassing any input filtering on the login endpoint itself.\n\n---\n\n## Impact\n\n- Remote Code Execution as the web server process user (`www-data`)\n- Payload persists across sessions (stored in DB)\n- No PHP file write required \u2014 evades file-integrity monitoring\n- Triggers silently on every login \u2014 no user interaction visible\n- Chains with any SQLi vulnerability in e107 to form a complete unauthenticated RCE path\n\n---\n\n## Proof of Concept\n\n*Tested on e107 v2.3.x (Docker, local environment)*\n\n```bash\n# Step 1: Store payload in user_prefs via SQL injection or DB access\n# (payload passes the 'array' prefix guard)\n# Stored value: array(0 => file_put_contents('/tmp/pwned.txt', posix_getlogin()))\n\n# Step 2: Trigger by logging in as the affected user\n# On login, core_functions.php:657 evals the stored payload\n\n# Step 3: Verify\ncat /tmp/pwned.txt\n# Output: www-data\n```\n\nBlind execution confirmed \u2014 output visible via file write side-channel, not in HTTP response.\n\n---\n\n## Fix Recommendation\n\nReplace `eval()` with a safe deserializer. e107 already uses `json_encode`/`json_decode` in newer code paths \u2014 the legacy `eval()` branch should be removed entirely:\n\n```php\n// BEFORE (vulnerable):\n$ArrayData = '$data = ' . $ArrayData . ';';\n@eval($ArrayData);\n\n// AFTER (safe):\n// Remove the eval() branch entirely.\n// Use json_decode() for all user_prefs values.\n// Migrate existing eval-format rows during upgrade.\n```\n\nAlternatively, add strict allowlisting so only known-safe array keys/values are accepted \u2014 but removing `eval()` entirely is the only safe fix.\n\n---\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-07-14 | Vulnerability discovered and verified on local Docker instance |\n| 2026-07-17 | Submitted to VulnCheck CVD |\n| 2026-07-17 | CVE-2026-57859 provisionally allocated by VulnCheck |\n| 2026-07-17 | VulnCheck initiated outreach to e107 vendor |\n| 2026-11-14 | 120-day disclosure deadline |\n\n---\n\n## References\n\n- [e107 GitHub Repository](https://github.com/e107inc/e107)\n- [Vulnerable file: core_functions.php](https://github.com/e107inc/e107/blob/master/e107_handlers/core_functions.php)\n- [CWE-94: Improper Control of Generation of Code](https://cwe.mitre.org/data/definitions/94.html)\n- [CVSS 3.1 Vector: AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n---\n\n*Discovered by: Saidakbarxon Maxsudxonov (@sermikroo)*  \n*Coordinated disclosure via VulnCheck CVD Program*", "creation_timestamp": "2026-07-20T23:39:51.395012Z"}, {"uuid": "af5a3d09-fffc-4c00-a705-8c382164c912", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57859", "type": "seen", "source": "https://gist.github.com/sermikr0/6f68b5bcfc1024269f1cd032abb55a0f", "content": "# CVE-2026-57859 \u2014 e107 CMS: Second-Order Persistent RCE via `eval()` in Legacy `user_prefs` Deserialization\n\n**Severity:** HIGH (CVSS 8.1)  \n**CWE:** CWE-94 \u2014 Code Injection  \n**Affected:** e107 CMS v2.3.x (all current versions)  \n**Status:** \u26a0\ufe0f Unpatched \u2014 Vendor notified via VulnCheck CVD (2026-07-17)  \n**CVE ID:** CVE-2026-57859 (allocated by VulnCheck)\n\n---\n\n## Summary\n\ne107's `e107::unserialize()` function contains a legacy deserialization path in `e107_handlers/core_functions.php` that passes database-stored content directly into PHP's `eval()`. Any value in the `user_prefs` database column that begins with the string `array` is evaluated as PHP code on every user login. An attacker who can write to `user_prefs` (via SQL injection, IDOR, or direct DB access in a multi-tenant scenario) achieves persistent Remote Code Execution without writing a PHP file.\n\n---\n\n## Vulnerable Code\n\n**File:** `e107_handlers/core_functions.php` \u2014 lines 651\u2013657\n\n```php\n$ArrayData = trim($ArrayData);\n\n// Only guard: value must begin with 'array' (case-insensitive)\nif (stripos($ArrayData, 'array') !== 0) {\n    return false;\n}\n\n// Vulnerable: user-controlled $ArrayData passed directly to eval()\n$ArrayData = '$data = ' . $ArrayData . ';';\ntry {\n    @eval($ArrayData);   // \u2190 SINK: arbitrary PHP code execution\n} catch (ParseError $e) {\n    ...\n}\n```\n\nThe guard `stripos($ArrayData, 'array') !== 0` only checks that the value **starts with** `array`. Any PHP expression valid as an array element \u2014 including function calls like `system()`, `passthru()`, `file_put_contents()` \u2014 passes this check.\n\n---\n\n## Call Chain (Triggered on Login)\n\n```\nHTTP POST /e107_web/index.php (login request)\n  \u2514\u2500 e107_handlers/login.php:472\n       \u2514\u2500 e107::getArrayStorage()->unserialize($userData['user_prefs'])\n            \u2514\u2500 e107_handlers/core_functions.php:651 \u2014 legacy branch\n                 \u2514\u2500 @eval('$data = ' . $user_prefs . ';')\n                      \u2514\u2500 ARBITRARY CODE EXECUTES as web server user\n```\n\nThe payload is **persistent**: once stored in `user_prefs`, it executes on **every subsequent login** for that user account.\n\n---\n\n## Attack Scenario\n\n**Prerequisite:** Write access to the `user_prefs` column (via SQL injection elsewhere in e107, IDOR, or admin-level access in a compromised environment).\n\n**Payload stored in `user_prefs`:**\n```\narray(0 => system('id'))\n```\n\n**What eval() executes:**\n```php\n$data = array(0 => system('id'));\n```\n\n**Result:** `system('id')` executes server-side, returning `uid=33(www-data)`.\n\n**Why this is second-order:** The payload is written to the database in one request and triggered on a later, unrelated login request \u2014 bypassing any input filtering on the login endpoint itself.\n\n---\n\n## Impact\n\n- Remote Code Execution as the web server process user (`www-data`)\n- Payload persists across sessions (stored in DB)\n- No PHP file write required \u2014 evades file-integrity monitoring\n- Triggers silently on every login \u2014 no user interaction visible\n- Chains with any SQLi vulnerability in e107 to form a complete unauthenticated RCE path\n\n---\n\n## Proof of Concept\n\n*Tested on e107 v2.3.x (Docker, local environment)*\n\n```bash\n# Step 1: Store payload in user_prefs via SQL injection or DB access\n# (payload passes the 'array' prefix guard)\n# Stored value: array(0 => file_put_contents('/tmp/pwned.txt', posix_getlogin()))\n\n# Step 2: Trigger by logging in as the affected user\n# On login, core_functions.php:657 evals the stored payload\n\n# Step 3: Verify\ncat /tmp/pwned.txt\n# Output: www-data\n```\n\nBlind execution confirmed \u2014 output visible via file write side-channel, not in HTTP response.\n\n---\n\n## Fix Recommendation\n\nReplace `eval()` with a safe deserializer. e107 already uses `json_encode`/`json_decode` in newer code paths \u2014 the legacy `eval()` branch should be removed entirely:\n\n```php\n// BEFORE (vulnerable):\n$ArrayData = '$data = ' . $ArrayData . ';';\n@eval($ArrayData);\n\n// AFTER (safe):\n// Remove the eval() branch entirely.\n// Use json_decode() for all user_prefs values.\n// Migrate existing eval-format rows during upgrade.\n```\n\nAlternatively, add strict allowlisting so only known-safe array keys/values are accepted \u2014 but removing `eval()` entirely is the only safe fix.\n\n---\n\n## Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-07-14 | Vulnerability discovered and verified on local Docker instance |\n| 2026-07-17 | Submitted to VulnCheck CVD |\n| 2026-07-17 | CVE-2026-57859 provisionally allocated by VulnCheck |\n| 2026-07-17 | VulnCheck initiated outreach to e107 vendor |\n| 2026-11-14 | 120-day disclosure deadline |\n\n---\n\n## References\n\n- [e107 GitHub Repository](https://github.com/e107inc/e107)\n- [Vulnerable file: core_functions.php](https://github.com/e107inc/e107/blob/master/e107_handlers/core_functions.php)\n- [CWE-94: Improper Control of Generation of Code](https://cwe.mitre.org/data/definitions/94.html)\n- [CVSS 3.1 Vector: AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)\n\n---\n\n*Discovered by: Saidakbarxon Maxsudxonov (@sermikroo)*  \n*Coordinated disclosure via VulnCheck CVD Program*", "creation_timestamp": "2026-07-21T00:00:00.001838Z"}, {"uuid": "b3bec575-e576-4d79-bcec-1b47f1bdd7d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-57852", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr4vqc72kz2e", "content": "CVE-2026-57852 - Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check\nCVE ID : CVE-2026-57852\n \n Published : July 20, 2026, 10:17 p.m. | 3\u00a0hours, 27\u00a0minutes ago\n \n Description : Grav CMS scheduler-webhook plugin contains an authentication bypa...", "creation_timestamp": "2026-07-21T03:50:29.940918Z"}]}