mcorybillington

5 exploits Active since Nov 2020
CVE-2020-28328 NOMISEC HIGH WRITEUP
SuiteCRM < 7.11.17 - Remote Code Execution via Log File Name Setting
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.
2 stars
CVSS 8.8
CVE-2025-34323 GITHUB HIGH python WORKING POC
Nagios Log Server < 2026R1.0.1 - Local Privilege Escalation via Sudo Misconfiguration and Group-Writable Scripts
Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. The 'www-data' user is a member of the 'nagios' group, which has write access to '/usr/local/nagioslogserver/scripts', while several scripts in this directory are owned by root and may be executed via sudo without a password. A local attacker running as 'www-data' can move one of these root-owned scripts to a backup name and create a replacement script with attacker-controlled content at the original path, then invoke it with sudo. This allows arbitrary commands to be executed with root privileges, providing full compromise of the underlying operating system.
CVSS 7.8
CVE-2025-64328 NOMISEC HIGH WORKING POC
FreePBX 17.0.2.36-17.0.3 - Authenticated OS Command Injection via SSH Connection Test
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.
CVSS 7.2
CVE-2025-34227 NOMISEC HIGH WORKING POC
Nagios XI < 2026R1 - Authenticated OS Command Injection via Database Wizard Arguments
Nagios XI < 2026R1 is vulnerable to an authenticated command injection vulnerability within the MongoDB Database, MySQL Query, MySQL Server, Postgres Server, and Postgres Query wizards. It is possible to inject shell characters into arguments provided to the service and execute arbitrary system commands on the underlying host as the `nagios` user.
CVSS 8.8
CVE-2025-34322 NOMISEC HIGH WORKING POC
Nagios Log Server < 2026R1.0.1 - Authenticated OS Command Injection via Natural Language Queries
Nagios Log Server versions prior to 2026R1.0.1 contain an authenticated command injection vulnerability in the experimental 'Natural Language Queries' feature. When this feature is configured, certain user-controlled settings—including model selection and connection parameters—are read from the global configuration and concatenated into a shell command that is executed via shell_exec() without proper input handling or command-line argument sanitation. An authenticated user with access to the 'Global Settings' page can supply crafted values in these fields to inject additional shell commands, resulting in arbitrary command execution as the 'www-data' user and compromise of the Log Server host.
CVSS 7.2