Tag
#Unauthenticated Vulnerability
CVE-2026-108107: Unauthenticated SQL Injection in PHPNuxBill
A critical vulnerability (CVE-2026-108107, CVSS 9.8) exists in PHPNuxBill versions up to 2025.3.20, allowing unauthenticated attackers to inject SQL via the radius.php FreeRADIUS REST endpoint. This could lead to extraction of customer records and credentials. Immediate action is required to update vulnerable installations.
CVE-2026-86242: Unauthenticated Remote Code Execution in Bifrost HTTP Transport
CVE-2026-86242 is a high-severity vulnerability in Bifrost HTTP transport versions before 2.0.0. An unauthenticated attacker can exploit this vulnerability by sending a POST request to /api/plugins with a custom plugin path as an HTTP URL, leading to potential remote code execution or server-side request forgery. The vulnerability has a CVSS score of 8.1 and requires immediate attention.
Understanding and Defending Against Unauthenticated SQL Injection in GeoDirectory
This educational analysis covers CVE-2026-54831, an unauthenticated SQL injection vulnerability in the GeoDirectory WordPress plugin versions up to 2.8.162. The vulnerability has a CVSS score of 9.3, indicating critical severity. We will delve into the root cause, attack surface, exploitation mechanics, real-world impact, detection, and defense strategies.