vulncheck.com resources

vulncheck.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-11-07.

RCE 3 CSRF 2 GraphQL 1 Python 1 SQLi 1 SSTI 1

Date Added	Resource	Excerpt
2026-11-07 2026	vtenext CSRF protection bypass via HTTP method tampering CSRF	A Cross-Site Request Forgery (CSRF) protection bypass vulnerability (CVE-2025-71454) has been identified in vtenext versions prior to 25.02.2. This medium severity flaw (CVSS 6.9) can be exploited through HTTP method tampering. The vulnerability allows an attacker to potentially perform unauthorized actions on behalf of a logged-in user. No bounty payout amount is specified.
2026-11-07 2026	LMFDB unauthenticated Jinja SSTI (CVE-2026-123198)Python RCE SSTI	A critical unauthenticated Jinja Server-Side Template Injection (SSTI) vulnerability, CVE-2026-123198, has been discovered in LMFDB. The vulnerability affects versions of LMFDB greater than or equal to 0 and less than 01829bd09b692c720aad30c952758a20630573d4. With a high CVSS score of 9.3, this flaw allows attackers to execute arbitrary code on the server without authentication. No bounty payout amount is mentioned.
2026-11-06 2026	Dromara SkyEye SQL injection via keyword parameter SQLi	A SQL injection vulnerability exists in Dromara SkyEye, specifically in versions up to commit `65d3ddcede701d33ea5416e47c9b656e47d56401`. This vulnerability, identified as CVE-2026-110609, is rated as HIGH severity with a CVSS score of 7.1. It is exploitable via the keyword parameter. No bounty payout amount is mentioned in the provided information.
2026-11-02 2026	Webasyst Photos app CSRF via backend actions (CVE-2026-116210)CSRF	A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Webasyst Photos app (CVE-2026-116210). This high-severity flaw, with a CVSS score of 7.1, affects Webasyst Framework versions up to and including 4.4.0. The vulnerability allows attackers to perform backend actions without user consent. No specific bounty payout amount is mentioned in the provided content.
2026-08-07 2026	Zbtlink Routers Contain rctl Backdoor RCE	Writeup on ENDLESSDOORS, a backdoor found in Zbtlink and other white-labeled routers. This implant, a customized version of the rctl tool, allows for remote command execution and reverse shell capabilities by exploiting a vulnerability present in numerous firmware images across models like Z8102AX-2DSIM and WG3526. The backdoor phones home to specific endpoints, enabling attackers to hijack communications and gain root access without inbound connectivity. Affected devices should be identified by model number and checked for the presence of the 'kworker' process and associated files.
2026-04-19 2026	Command Injection in Jenkins via Git Parameter (CVE-2025-53652)RCE	Writeup of CVE-2025-53652 in Jenkins, detailing command injection via the Git Parameter plugin. Attackers can exploit unvalidated Git parameters to achieve remote code execution, leveraging Git's GTFObin capabilities to execute arbitrary commands like `sleep` or establish reverse shells. The vulnerability requires a valid session cookie, build name, and Jenkins crumb for exploitation, even in unauthenticated instances. Detection is possible through Suricata rules and analysis of Jenkins job logs.
2026-04-17 2026	Hasura GraphQL 1.3.3 Local File Read via SQL Injection GraphQL	Advisory detailing a local file read vulnerability in Hasura GraphQL 1.3.3, exploitable via SQL injection. Attackers can leverage the `pg_read_file()` function through crafted queries on the query endpoint to access arbitrary files on the server, impacting systems running this version.