ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
CVE Analysis
•2026-11-03
•9 min read
Gravity Forms CVE-2026-103039: Unauthenticated PHP Object Injection with a Public PoC
A summary of CVE-2026-103039, an unauthenticated PHP object injection flaw in Gravity Forms through 3.1.2, with technical analysis, a public PoC review, and the patch details for version 3.1.3.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•8 min read
Overview of CVE-2026-104080: Root OS Command Injection in Control Web Panel's /valid_token/ Loopback API
A brief summary of CVE-2026-104080, an OS command injection in Control Web Panel's tokenless /valid_token/ loopback API route that lets a crafted 'user' value run commands as root. It covers the root cause, the attack chain context, how the fix in 1.29/1.30 works, and affected versions.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•9 min read
Overview of CVE-2026-107750: Entity Encoding Bypass Leads to Stored XSS in PDF Invoices & Packing Slips for WooCommerce
CVE-2026-107750 is an unauthenticated stored XSS in PDF Invoices & Packing Slips for WooCommerce through 5.16.4. Entity-encoded payloads bypass the earlier CVE-2026-92244 fix. This post summarizes the flaw and reviews the 5.16.5 patch.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•8 min read
Overview of CVE-2026-115290: Unauthenticated Uncontrolled Recursion Denial of Service in the Elasticsearch Remote Cluster Server Interface
A brief summary of CVE-2026-115290, an uncontrolled recursion flaw that lets an unauthenticated attacker terminate Elasticsearch nodes through the remote cluster server interface. Covers affected versions, Elastic's fixed releases, interim controls and detection guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•10 min read
Brief summary: Avada theme CVE-2026-115346, unauthenticated arbitrary file upload with possible RCE
CVE-2026-115346 is an unauthenticated arbitrary file upload flaw in Avada Forms upload fields that affects Avada through 7.16.2. This summary covers the root cause, the 7.16.4 patch, the 7.16.3 version gap, and practical detection approaches.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•14 min read
Overview of CVE-2026-116238: pgAdmin 4 Server Mode Login Lockout Bypass and Authorization Flaws
A brief summary of CVE-2026-116238, a set of pgAdmin 4 server-mode flaws before 9.19 that gave unauthenticated attackers unlimited password guesses against internal accounts, including the administrator's. The post covers the root cause, the three fix commits and practical detection approaches.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•9 min read
Brief Summary: pgAdmin 4 CVE-2026-116241 OS Command Injection via Import/Export Data
A brief summary of CVE-2026-116241, a critical OS command injection flaw in pgAdmin 4's Import/Export Data tool that bypasses the earlier CVE-2026-17566 fix. Includes patch and detection information.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•9 min read
Brief Summary: MLflow CVE-2026-118628, Unauthenticated get-artifacts SSRF with PoC and Patch Analysis
A brief summary of CVE-2026-118628, an unauthenticated server-side request forgery in MLflow's get-artifacts function, with the public request-level PoC and details of the MLflow 3.17.0 fix.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•10 min read
Brief Summary: Google Chrome CVE-2026-119263 GarbageCollection Memory Corruption with Potential Sandbox Escape
A brief summary of CVE-2026-119263, a memory corruption flaw in Google Chrome's GarbageCollection component that could allow code execution outside the sandbox via a crafted HTML page. Google fixed it in 156.0.8078.79. The post covers the known technical scope, patch and packaging status, and version-based detection options.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•9 min read
Brief Summary: Google Chrome Dawn WebGPU Memory Corruption (CVE-2026-119264) Allowing Sandboxed Code Execution
A brief summary of CVE-2026-119264, a High-severity memory corruption flaw in Dawn, the WebGPU implementation in Google Chrome, fixed in 156.0.8078.79. Covers what the public record establishes, patch and downstream package status, and detection of exposed builds.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•10 min read
Brief Summary: Google Chrome Quota Memory Corruption (CVE-2026-119265) Allowing Sandboxed Code Execution
A brief summary of CVE-2026-119265, a High-severity memory corruption bug in the Quota component of Google Chrome before 156.0.8078.79. The post covers what is publicly known, the fixed builds and downstream packages, and version-based detection options.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•9 min read
Quick Look: CVE-2026-119266, a Use After Free in Google Chrome's Quota Component
A brief summary of CVE-2026-119266, a high-severity use after free in Chrome's Quota component that may allow code execution inside the sandbox through a crafted HTML page. It covers the fixed versions, how to deploy the patch, and how to detect exposure.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•14 min read
Overview of CVE-2026-119977: WordPress Core Upgrade Window Race Condition Enabling Unauthenticated RCE
A brief summary of CVE-2026-119977, a race condition in WordPress Core 4.7 through 7.1.3 where predictable, web-accessible staging paths used during full-package upgrades can allow unauthenticated code execution. Covers the root cause, the 7.1.4 patch and branch backports, and published detection guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•9 min read
Brief Summary: Easy Digital Downloads CVE-2026-120538 PayPal Guest Checkout Authentication Bypass
A brief summary of CVE-2026-120538, an authentication bypass in the Easy Digital Downloads WordPress plugin through 3.7.2 that can lead to administrator account takeover via PayPal guest checkout. Includes patch and detection details.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•9 min read
Brief Summary: SureCart <= 4.9.5 Unauthenticated Account Takeover (CVE-2026-120574)
A brief summary of CVE-2026-120574, an unauthenticated account takeover in the SureCart WordPress plugin through version 4.9.5, with a review of the 4.9.6 patch internals.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•10 min read
Brief Summary: CVE-2026-121802, a Signing Oracle in the Better Auth Expo Authorization Proxy Enabling Account Takeover
A brief summary of CVE-2026-121802, where the Better Auth Expo authorization proxy signed attacker-supplied state with the application secret and enabled unauthenticated account takeover. Covers root cause, the fix in 1.7.16 and 1.8.0 beta 5, required secret rotation, and detection guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•8 min read
Brief Summary: CVE-2026-13594, an Improper Access Control Flaw in ManageEngine Log360 and EventLog Analyzer
A brief summary of CVE-2026-13594, a CVSS 9.1 improper access control flaw in ManageEngine Log360 and EventLog Analyzer that could allow unauthorized access to the product. The post covers the vendor fix in build 13062, the NVD version wording discrepancy, and how to apply the service pack.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•9 min read
Technical Overview: Apache Fineract CVE-2026-64618 SQL Injection in the Advanced Search API
A brief summary of CVE-2026-64618, a CVSS 9.8 SQL injection in the Apache Fineract advanced search API. It covers the root cause in operator concatenation, the allowlist fix in PR 6153, and the affected versions.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•11 min read
Control Web Panel CVE-2026-73697: File Write and OS Command Injection in phpini_editor
CVE-2026-73697 is a dual arbitrary file write and OS command injection flaw in Control Web Panel's phpini_editor user module. Here is the patch and detection guidance drawn from VulnCheck's research.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•11 min read
Brief Summary: Control Web Panel CVE-2026-77878, Root OS Command Injection via the restoredatabase API
A brief summary of CVE-2026-77878, an OS command injection in Control Web Panel's loopback database restore API that runs as root, including patch and detection guidance.
Gaurav Sarraf
