Attributed metadata history
Up to 100 retained publisher events per page for b452bbac2860715f7e4e0bade0f266d831cff79aa2d530d434100065db68de99. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_dd4a4c98d64bc46b3f
observed · 2026-10-12 15:55:05 UTC
VulnCheck's Initial Access Intelligence team details an unauthenticated remote root RCE in the Virtualizor admin panel, where the pre-auth billing-module hook is guarded only against requests whose act is not 'login', so act=login walks straight into it, the hook unserializes an attacker POST field and splices its uid into a root shell, and the parameterized queries do not help because MySQL casts the injected string back to the integer the query expects.
Fingerprint: 971ff86584048bcf9fd4d55e65a24f327a907685cd6929ed471c86201071a3ae
intelligence_src_dd4a4c98d64bc46b3f
observed · 2026-10-12 15:55:04 UTC
available
Fingerprint: 412205efeb4951e4cf52e76cd81d6198ec880146f81b3192d0a4bbd93bc7c1d1