CVE-2026-6149

rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability. An unauthenticated attacker can push a crafted serialized job onto the Redis-backed Laravel Horizon queue, leading to arbitrary code execution via the App\Jobs\TaskDownloadRun class and the bundled laravel/tinker package.

WidzialniCMS is vulnerable to unrestricted file upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.

WidzialniCMS is vulnerable to unrestricted file upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any location on the server, leading to remote code execution.

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

The Confection WordPress Cable plugin from 0.4.0 to 0.4.7 does not perform capability or nonce checks before saving its settings and writes one of them unmodified into a standalone PHP file that it then serves. This allows unauthenticated users to execute arbitrary PHP code on the server.

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP devices within the web administration interface. The add_expmac function in var/html/webserver mishandles the mac argument, resulting in OS command injection. The attack can be performed remotely and a public exploit is available.

The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When GITHUB_WEBHOOK_SECRET is unset or empty (default None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the host.

A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP version 1.0 B-MB3W202-210825-r11775, affecting the handle_wechat_cn_wifi function in var/html/webserver within the Weixin Auth Endpoint component. Manipulation of the extend argument results in OS command injection. The attack can be executed remotely and the exploit has been made public.

A weakness has been identified in Intelbras SG 2404 PoE L2+ versions 1.00.70 and 1.00.72, affecting an unknown function in the /EXCU_SHELL file within the Web Management Interface component. Manipulation can lead to improper authentication. The attack can be launched remotely and the exploit has been made publicly available.

Buffer overflow in the data receiving process in NEC WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.