Skip to content

Instantly share code, notes, and snippets.

View sermikr0's full-sized avatar
💭
🛡️ Researching & Security

Saidakbarxon Maxsudxonov sermikr0

💭
🛡️ Researching & Security
17 followers · 0 following
View GitHub Profile
@sermikr0
sermikr0 / CVE-2026-57863.md
Last active August 25, 2026 07:13
CVE-2026-57863 — ZIP-Slip via Updater Endpoint Enables RCE in Crater Invoice

CVE-2026-57863 — ZIP-Slip via Updater Endpoint Enables RCE in Crater Invoice

Overview

Field Value
CVE ID CVE-2026-57863
Product Crater Invoice
Affected Versions ≤ 6.0.6 (all versions, last release 2022-03-06)
Vulnerability Type ZIP-Slip Path Traversal → Remote Code Execution
@sermikr0
sermikr0 / CVE-2026-65711.md
Created July 24, 2026 04:16
CVE-2026-65711 — sysPass OS Command Injection via Admin-Configurable Backup Path

CVE-2026-65711 — sysPass: OS Command Injection via Admin-Configurable Backup Path

CVE ID: CVE-2026-65711
Product: sysPass Password Manager
Repository: https://github.com/nuxsmin/sysPass
Affected Versions: All versions up to and including v3.2.11 (last release 2022-07-02)
Fixed Version: None — project abandoned (no commit in 4+ years)
Vulnerability Type: OS Command Injection (CWE-78)
CVSS 3.1 Score: 7.2 HIGH
CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

@sermikr0
sermikr0 / gist:d5e6a93f199c29583d3f16efc59fb16e
Created July 22, 2026 11:24
wefwqedw
@sermikr0
sermikr0 / CVE-2026-57859-e107-eval-rce.md
Created July 20, 2026 23:39

CVE-2026-57859 — e107 CMS: Second-Order Persistent RCE via eval() in Legacy user_prefs Deserialization

Severity: HIGH (CVSS 8.1)
CWE: CWE-94 — Code Injection
Affected: e107 CMS v2.3.x (all current versions)
Status: ⚠️ Unpatched — Vendor notified via VulnCheck CVD (2026-07-17)
CVE ID: CVE-2026-57859 (allocated by VulnCheck)

@sermikr0
sermikr0 / kanboard-ssrf-hexip-bypass.md
Created July 18, 2026 09:01

Kanboard ≤ 1.2.52 — SSRF Filter Bypass via Hexadecimal IP Notation (CWE-918)

Product: Kanboard project management software
Affected versions: 1.2.52 (latest stable, April 2026) and all prior versions
Fixed version: None (unpatched as of 2026-07-18)
CVSS v3.1: 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CWE: CWE-918 (Server-Side Request Forgery)
Reporter: Saidakbarxon Maxsudxonov

@sermikr0
sermikr0 / CVE-2026-58143_README.md
Last active July 10, 2026 00:23
CVE-2026-58143 & CVE-2026-58144 — Cotonti CMS CSRF to RCE and Stored XSS PoC

CVE-2026-58143 — Cotonti CMS CSRF Chain to Remote Code Execution

Overview

Field Value
CVE ID CVE-2026-58143
Product Cotonti CMS (CMF)
Affected Version ≤ 0.9.x
CVSS 3.1 Score 9.6 CRITICAL
@sermikr0
sermikr0 / CVE-2026-57518.md
Created June 26, 2026 15:46
CVE-2026-57518 — Pagekit CMS 1.0.18 Privilege Escalation to RCE

CVE-2026-57518 — Pagekit CMS 1.0.18 Privilege Escalation → RCE

CVE: CVE-2026-57518
Product: Pagekit CMS 1.0.18 (https://github.com/pagekit/pagekit)
CVSS 3.1: 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-269 Improper Privilege Management
Reporter: Saidakbarxon Maqsudxonov / saidakbarxonmaqsudxonov4@gmail.com
Date: 2026-06-26