Adobe, Joomla Extensions Hit By Critical Flaws
Critical RCE, code injection, and SSRF flaws disclosed in Adobe Campaign Classic and multiple Joomla extensions today.
Multiple critical vulnerabilities have been disclosed in Adobe Campaign Classic (ACC), including code injection and server-side request forgery (SSRF) flaws. CVE-2026-75699 and CVE-2026-89276 describe code injection vulnerabilities that could lead to arbitrary code execution. CVE-2026-82013 details an SSRF vulnerability that may allow privilege escalation. These vulnerabilities could be exploited by attackers to gain unauthorized access and control over affected systems. As detailed by Vypr Intelligence, these issues collectively pose a significant risk to organizations using ACC.
A critical command injection vulnerability in Dahua EIMS versions prior to 2240008 (CVE-2024-13985) allows unauthenticated remote attackers to execute arbitrary system commands. This is achieved through the capture_handle.action interface, exploiting improper input validation. The high risk score associated with this CVE highlights the potential for severe impact if exploited.
Several critical vulnerabilities have been identified in Joomla extensions, including remote code execution (RCE), SQL injection, and path traversal flaws. CVE-2026-97163 and CVE-2026-97160 detail RCE and command injection vulnerabilities in the UP plugin extension from lomart.fr, affecting versions up to 5.2.0 and 6.0.29. Additionally, CVE-2026-97161 points to path traversal issues within the same extension. CVE-2026-94130 describes an unauthenticated SQL injection vulnerability in the YouTube Gallery extension from joomlaboat.com, impacting versions prior to 5.7.3. These collectively allow for significant compromise of Joomla sites, as reported by Vypr Intelligence.
Critical vulnerabilities have been disclosed in Fortinet FortiPAM Chrome Extension, including an improper restriction of rendered UI layers or frames vulnerability (CVE-2026-84388). This flaw could allow unauthenticated remote attackers to disclose information. The Hacker News and SecurityWeek reported on Fortinet's patching of these vulnerabilities.
A critical OS command injection vulnerability exists in the Wikimedia Foundation Mediawiki ExternalData Extension (CVE-2026-100382). This flaw stems from improper neutralization of special elements used in OS commands, allowing attackers to inject and execute arbitrary commands on the server. The high CVSS score indicates a severe security risk.
Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are affected by a remote code execution vulnerability (CVE-2024-32641) in the addParam function. This function improperly handles user input, enabling attackers to execute arbitrary code on the server. The critical severity and high risk score underscore the importance of patching this vulnerability.
QiAnXin TianQing Management Center versions up to and including 6.7.0.4130 contain a path traversal vulnerability (CVE-2024-13984) in the rptsvr component. This allows unauthenticated attackers to upload files to arbitrary locations on the server, potentially leading to further compromise.
H3C Intelligent Management Center (IMC) versions up to and including E0632H07 have a remote command execution vulnerability (CVE-2024-13980) in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft malicious requests to execute commands on the affected devices.
LiveBOS, an object-oriented business architecture middleware suite, has an arbitrary file upload vulnerability (CVE-2024-13981) in its UploadFile.do;.js.jsp endpoint. This flaw affects the LiveBOS Server component and could allow attackers to upload and execute malicious files on the server.
Claroty devices are affected by two critical vulnerabilities. CVE-2023-49900 is an improper sanitization of user input in the SetParameter command, leading to remote code execution. CVE-2023-49899 allows unauthenticated remote attackers to execute any command due to improper verification of communication channel origins. Both vulnerabilities carry a high risk score.
OpenStack Zaqar versions before 22.0.2 have a vulnerability (CVE-2026-97404) where the WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID can bypass Keystone authentication, potentially leading to unauthorized access.
Airc.pt/solucoes-servicos.solucoes MyNET versions up to and including v.26.06 are vulnerable to an iframe injection flaw (CVE-2024-27708). This allows remote attackers to execute arbitrary code by manipulating the src parameter.
Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806, and Synology Unified Controller (DSMUC) before 3.1.4-23079 are affected by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2024-45538) in the WebAPI Framework. This could allow remote attackers to execute arbitrary code by tricking users into performing unintended actions.
AcyMailing Enterprise extension versions prior to 11.1.0 contain a Remote Code Execution vulnerability (CVE-2026-94132) in its mailbox action feature. MIME parts of incoming emails were saved without proper extension checks, allowing attackers to upload and execute malicious files.