PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Logic Flaw Leading to RCE in Dynamicweb 9.5.0 - 9.12.7

slcyber.io | research | #rce | #vulnerability-research | #exploitation | #logic-flaw | #dynamicweb
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A logic flaw in Dynamicweb's setup wizard allows unauthenticated creation of administrator accounts, leading to RCE. Patched in 9.12.8.
Published
Collected

Related coverage

research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · lab.ctbb.show
Write Path Traversal to a RCE Art Department
# Write Path Traversal to a RCE Art Department ~/authors/fsi - profile fsi * * * Diyan Apostolov Nov 28, 2025 CriticalThinking Research members are treated as artists thus here is my small and...
vulnerability · slcyber.io
Advisory: Dynamicweb Logic Flaw Leading to RCE (CVE-2022-25369)
An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication via a logic flaw.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
Back