Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-8054 — dotCMS Core Publish Audit API SQL Injection

aretiq.ai | research | CVE-2026-8054 | #vulnerability-research | #sql-injection | #pre-auth | #cve-2026-8054 | #dotcms | #content-management-system

Summary

CVE-2026-8054: unauthenticated SQL injection in dotCMS's /api/auditPublishing/getAll endpoint gives full read, modify and delete access to the PostgreSQL database in one request.
CVE
CVE-2026-8054
Published
Collected

original ↗

Related coverage

vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
research · bughunters.google.com
Google's PageBreak Project – Real-World Findings
This post provides a technical deep dive into specific, real-world vulnerabilities discovered by Google's PageBreak scanner
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
research · starlabs.sg
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Post-auth RCE in Cisco Smart Software Manager (CSSM): command injection in nginx certificate upload, where openssl checks run via childProcess.execSync. Cisco silently patched it in 10-202608.
research · idnsec.com
Hacking Campaign and SEO Cloaking of Indonesian Illegal Gambling
Cybercrime-as-a-Service crews hack websites into ad infrastructure for Indonesia's illegal gambling market, abusing SEO cloaking and AMP pages to rank gambling content in targeted search results.
research · idnsec.com
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth
Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.
back