Security blog: CVE, PoC & CMS guides

PHP core multipart UAF pair CVSS 9.2. Emergency builds 8.2.35–8.5.12+. Inventory with GET check; armed/rce_hit only in lab. Repo murrez/php2shell.

LearnPress WordPress LMS ≤4.4.10: unauthenticated lp-ajax=checkout stores checkout-email → LP_Helper::maybe_unserialize. CVSS 9.8. Fixed 4.4.11. WAF, upgrade, and lab validation with poc.py.

Handlebars 4.0.0–4.7.9 with allowProtoMethodsByDefault: user templates → Function via constructor bypass. Fixed 4.7.10. Audit /render compile endpoints, not only npm audit.

Mage OSS through 0.9.80: unknown provider still mints JWT from email in session body. X-API-KEY, port 6789, PR #6204 fix. MLOps firewall and session monitoring.

Telegram Desktop ≤7.2.8: tg:// URI IPC record-separator injection can exfil local files after user clicks a link. Fixed 7.2.9. Endpoint patch cadence, not server-side WAF.

Theme My Login ≤7.2.1 on WordPress multisite with tml_user_passwords: retrieve_password() can apply attacker user_pass1 via ms filter. CVSS 9.8. Why checkemail=confirm lies, upgrade 7.2.2+.

Member toolkit: one-pass GB-scale ULP split into 40 categories (cPanel, WordPress, Joomla, phpMyAdmin). main.py workflow, stats-only mode, authorized inventory hygiene.

Abandoned Cart Pro ≤10.8.0: optional wcap_nonce + AES-CTR malleability on checkout_link → login as victim admin. CVSS 9.8. Upgrade >10.8.0, disable auto-login, treat recovery URLs as secrets.

nginx-ui 2.3.8–2.4.x: admin JWT downloads backup, forges app.ini TestConfigCmd, restore + POST /api/nginx/test → shell. Not CVE-2026-42238. Fixed 2.5.0. Panel segmentation, JWT hygiene, upgrade path.

Splunk Enterprise 10.2–10.4.x SHC: Patroni on :8008 accepts unauth PATCH /config + restart → PostgreSQL archive_command OS exec. SVD-2026-1001, CVSS 9.8. Upgrade 10.2.7/10.4.3, firewall peers, disable sidecar if unused.

com_simplemembership <7.4.0: unauthenticated SQLi on checkLoginPass login via extractvalue error leak. Upgrade 7.4.0+, audit OrdaSoft alongside other Joomla CVEs.

Smarty <4.5.8 / 5.x<5.8.5: forged assign() SmartyNocache markers in cache PHP → include() RCE. AT:P. Upgrade 4.5.8/5.8.5, flush template cache, audit Composer smarty/smarty.

Payload CMS plugin-import-export before 3.88.0: export-preview fields pollute Object.prototype → REST overrideAccess. Upgrade 3.88.0+, disable plugin or block export-preview until patched.

Self-hosted Jira, Confluence, Bitbucket: atlassian-plugins-webresource turns ..:: into ../ for unauthenticated WEB-INF reads—CVSS 9.3, not RCE. Patch DC builds, decode logs for :: traversal, rotate Crowd app passwords if needed.

RTU500 CMU firmware update endpoints accepted unauthenticated POST uploads—grid OT integrity risk, not another WordPress plugin story. Segment CMU interfaces, apply Hitachi advisories, lab-only PoC probes.

com_jctables ≤1.20.0 exposes unauthenticated format=json tasks that concatenate table names into SQL—read jos_users and more. Upgrade 1.21.1+, log getdatarow/getrow, treat hash leak as credential incident.

Joomla com_os_cck ≤8.3.15 exposes unauthenticated getContent uploads—magic-byte GIF check with attacker .php filenames. Upgrade to 8.3.16+, audit components/com_os_cck, and WAF com_os_cck POSTs during rollout.

WordPress 4.7.0–7.1.1 can include files via unvalidated pagename in get_page_template(); scanners chain PEAR gadgets toward RCE. Patch 7.1.2+ or branch backports, WAF traversal, and register_argc_argv hardening.

Divi Membership ≤2.3.0 process_paypal_callback on init trusts base64 paypal_param without IPN or signatures—arbitrary wp_set_auth_cookie. May register even when PayPal is off. Patch beyond 2.3.0 and hunt paypal_param in logs.

DevKit Pro ≤2.3.0 checks manage_options for the forged original_user_id cookie user, not the real requester—footer revert_switch nonces become pre-auth admin takeover. Upgrade 3.0.0+, disable Users Manager until patched.

LatePoint ≤5.7.0 stored [shortcode] payloads in guest booking names; Customer Cabinet output triggered a second do_shortcode pass. Patch 5.7.1, audit names, and harden public booking.

SiteSkite ≤2.1.8 let the siteskite_api_key mint admin cookies via ?token= autologin, then exposed MCP abilities that eval PHP. Upgrade to 2.2.0, rotate keys, and audit advanced tools.

MyPresta Google Merchant Center Feed ≤2.3.9 exposed unauthenticated file write on feed.php when export-to-disk URLs lacked per-shop secrets. Upgrade paths, detection, and why e-commerce RCE is never “just a module bug.”

Joomla Balbooa Forms before 2.4.3.4 can turn public submissions into code execution when PHP-after-submit actions embed field shortcodes in double-quoted strings. Patch, audit forms, and validate in a lab.

CVE-2026-101894 showed symlink-chain bypasses after earlier Zip Slip fixes. Upgrade paths, CI/upload blast radius, and how to prove containment in a lab—not just bump package.json.

Real Estate, Vehicle, and Book Library extensions fixed unauthenticated ORDER BY SQL injection in the same disclosure window. Inventory OrdaSoft components, map CVEs to versions, and validate patches without guessing.

Critical Citrix NetScaler ADC/Gateway flaws in DTLS (UDP/443) demand fast inventory, patch verification, and temporary mitigations. Step-by-step playbook for security and network teams.

OTP and MFA plugins can weaken wp-login.php when bypass options stack up. Learn misconfiguration patterns, patch urgency after plugin CVEs, and defender checks before public PoCs land.

Confidential computing and attested TLS (aTLS) fail when reports are not bound to trusted hardware. Learn verification steps, manifest allowlists, and how recent CVEs change operator checklists.

How to track IoT, router, and firmware CVEs without drowning in NVD noise—inventory, exposure checks, UDP services, and pairing live CVE feeds with pocbit.org PoC write-ups.

How to evaluate CVE write-ups, PoC repositories, and security blogs for accuracy—signal vs hype, vendor sources, and building a reading list that includes pocbit.org.

Virtual patching with WAF when plugin CVEs drop: rule sources, false positives, Cloudflare vs origin WAF, and when to remove rules after real patches ship.

What a public PoC archive is for, how pocbit.org organizes write-ups, and how defenders use PoCs responsibly for patch validation—not unauthorized scanning.

How pocbit.org CVE Detector tracks high-severity WordPress and Joomla CVEs, when to use it with NVD and CISA KEV, and how defenders turn alerts into patch tickets.

Learn a repeatable workflow to test CVE proof-of-concept code in an isolated lab—verify patches, tune WAF rules, and train SOC without touching production.

Critical CVSS is not enough. Use exposure, CISA KEV, public PoCs, and asset value to prioritize CVE patches on WordPress, Joomla, and custom apps.

Step-by-step Joomla hardening for 2026—core updates, VEL monitoring, component inventory, and how to respond when a Joomla CVE drops with a public PoC.

A complete WordPress security checklist for 2026—plugin CVE triage, admin exposure, backups, WAF rules, and safe PoC validation before attackers scan your site.

Vulnerabilities hide in npm packages, Composer libraries, and abandoned plugins. SBOMs, pinning, and monitoring reduce surprise when CVEs drop with public PoCs.

Upload forms power CMS media libraries—and RCE when extensions and MIME checks fail. Learn validation, storage outside webroot, and common CVE patterns.

A public PoC matched your stack, or logs look wrong—what now? Contain, preserve evidence, communicate, and avoid panic patching without snapshots.

Scanners find known issues fast; penetration tests model attacker chains. Set realistic outcomes for each and avoid checkbox security programs.

NVD enriches CVE records with CVSS, CWE, and references. Learn search habits, API rate limits, and how NVD complements pocbit.org PoCs and your patch queue.

Broken object level authorization and token validation bugs power modern breaches. Review JWT alg confusion, scope creep, and why public PoCs target REST plugins.

Web Application Firewalls block patterns at the edge; Runtime Application Self-Protection hooks into the app. Compare false positives, coverage, and PoC bypass realities.

Headers do not replace secure code, but they reduce XSS impact, clickjacking, and downgrade attacks. A practical guide for nginx, Apache, and Cloudflare users.

The Known Exploited Vulnerabilities catalog flags flaws actively used in the wild. Learn binding operational due dates, prioritization, and how KEV relates to CVE IDs.

Broken access control, cryptographic failures, injection—OWASP categories help teams speak the same language. Map each risk to practical controls and CVE triage habits.

CVE titles throw acronyms quickly. Understand when a bug gives shells from the network versus when an attacker already inside the box levels up to root.

SSRF makes your server fetch attacker-chosen URLs—often hitting 169.254.169.254 or internal admin panels. Learn detection, blocking, and why SSRF appears in modern CVE write-ups.

XSS turns browsers into attack proxies. Learn the three major types, why Content-Security-Policy matters, and how to triage XSS CVEs on CMS plugins.

Union-based, blind, second-order—SQLi still appears in CVEs and PoCs every week. Understand attack shapes, parameterized queries, and how defenders validate fixes.

Joomla sites rely on components, modules, and plugins with different update paths. Here is how to track Joomla CVEs, VEL advisories, and extension risk without guesswork.

Most WordPress compromises start with an outdated plugin, not core. Learn how to inventory extensions, prioritize CVEs, and test PoCs safely before attackers do.

When headlines mention “auth bypass” on a panel or API, these configuration and logging checks help you decide urgency before anyone runs a public PoC.

Advisories are written for busy admins. Learn the sections that matter—affected versions, fixed versions, workarounds—and the footnotes that save weekends.

Downloaded a PoC from pocbit.org or elsewhere? Run it only inside an isolated lab with snapshots, logging, and clear rules—not on production “for a minute.”

A 9.8 on a label is a formula output, not destiny. Learn what CVSS measures, what it ignores, and how to use it in triage.

Found a bug? The order of operations—verify, report, wait, publish—protects users and keeps researchers out of unnecessary legal gray zones.

A PoC shows that a vulnerability is real—not that you should run it on every host you can reach. Here is how researchers, defenders, and platforms like pocbit.org use the term.

CVE IDs are shared names for publicly known flaws—not severity scores, patch guarantees, or proof that your install is exploitable. A clear guide for triage and ticketing.