Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacktron finds pre-auth RCE in Dassault Delmia Apriso

hacktron.ai | vulnerability | #rce | #vulnerability-research | #pre-auth | #exploitation | #hacktron | #dassault | #delmia-apriso

Summary

A flaw that survived multiple audits and even ran in Apple's production turned out to be a full pre-auth RCE path in Dassault Delmia Apriso, which Hacktron mapped in about ten minutes.
Published
Collected

original ↗

Related coverage

vulnerability · idnsec.com
[CVE-2026-93485] Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core
An unauthenticated stored XSS (CVE-2026-93485) in WordPress core's wpautop() turns crafted comments into zero-click XSS, escalating to RCE via the admin session. Fixed in 7.1.1, backported to 4.7.36.
blog · projectzero.google
Taming the wild copy: Parallel Thread Corruption
A Google Project Zero post on a 'wild copy' parallel thread memory corruption bug and its exploitation.
research · projectzero.google
Finding and exploiting ntpd vulnerabilities
A Google Project Zero guest post telling how one of the researchers found and exploited vulnerabilities in the ntpd network time server.
Critical · vulnerability · github.com
CVE-2026-60004: Gitea diffpatch Git Hook Installation Remote Code Execution Exploit PoC
When self-registration is enabled, any unauthenticated attacker can create an account and immediately achieve host-level remote code execution on self-hosted Gitea instances.
vulnerability · projectzero.google
One font vulnerability to rule them all #2: Adobe Reader RCE exploitation
A Google Project Zero post that walks through developing a reliable exploit for an Adobe Reader font vulnerability to achieve remote code execution.
vulnerability · projectzero.google
(^Exploiting)\s*(CVE-2015-0318)\s*(in)\s*(Flash$)
A Google Project Zero write-up exploiting CVE-2015-0318, a bug in the PCRE regular expression engine as used in Adobe Flash.
back