PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Unauthorized RCE in VMware vCenter

swarm.ptsecurity.com | vulnerability | #rce | #vulnerability-research | #vmware | #cve | #ssrf
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Technical details of the VMware vSphere Client flaws found in fall 2020: an unauthorized file upload in the vropspluginui plugin leading to RCE (CVE-2021-21972) and an unauthenticated SSRF (CVE-2021-21973), both exploitable without credentials.
Published
Collected

Related coverage

research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · hunt.io
Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619)
Two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619, leaked pre-patch. We map the exposed PHP footprint and hunt open directories for exploitation.
vulnerability · hacktron.ai
PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)
Two unauthenticated RCE flaws in PHP, with exploitation attempts reported. Who is affected, how to check, and the fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35.
vulnerability · netspi.com
PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619
# PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619 October 21, 2026 ### Team NetSPI The PHP project has disclosed two critical vulnerabilities, CVE-2026-109618 and...
Back