>> TAG: #0day

CMSimple 5.4 – Local file inclusion (LFI) to Remote code execution (RCE) (Authenticated)

GNU gdbserver 9.2 – Remote Command Execution (RCE)

WordPress Plugin WP Guppy 1.1 – WP-JSON API Sensitive Information Disclosure

Linux Kernel 5.1.x – ‘PTRACE_TRACEME’ pkexec Local Privilege Escalation (2)

Webrun 3.6.0.42 – ‘P_0’ SQL Injection

Bus Pass Management System 1.0 – ‘Search’ SQL injection

FLEX 1085 Web 1.6.0 – HTML Injection

Pinkie 2.15 – TFTP Remote Buffer Overflow (PoC)

Modbus Slave 7.3.1 – Buffer Overflow (DoS)

Aimeos Laravel ecommerce platform 2021.10 LTS – ‘sort’ SQL injection