Loading story…
TWCERT/CC disclosed three critical vulnerabilities in BorG Technology Corporation's Borg SPM 2007 that can be exploited remotely without authentication. The issues are tracked as CVE-2026-6885, an arbitrary file upload flaw mapped to CWE-434 that allows attackers to upload and execute web shell backdoors; CVE-2026-6886, an authentication bypass mapped to CWE-1390 that lets attackers log in as any user; and CVE-2026-6887, a SQL injection flaw mapped to CWE-89 that enables arbitrary SQL commands against the backend database.
All three vulnerabilities carry high-severity impact ratings with CVSS v3.1 vectors of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating low-complexity network exploitation with no privileges or user interaction required. Successful attacks could lead to arbitrary code execution, unauthorized account access, and the reading, modification, or deletion of database contents, creating a path to full compromise of exposed Borg SPM 2007 deployments. The product is described as having ended sales in 2008, but systems still in operation remain at risk.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
TWCERT/CC published advisory references in both English and Chinese for CVE-2026-6885, CVE-2026-6886, and CVE-2026-6887. These advisories publicly documented the vulnerabilities and their impact on Borg SPM 2007.
A CVE entry was published for a SQL injection vulnerability in Borg SPM 2007 that allows unauthenticated remote attackers to inject arbitrary SQL commands and read, modify, or delete database contents. The issue was classified as CWE-89 and assigned a critical CVSS v3.1 vector reflecting high impact across confidentiality, integrity, and availability.
A CVE entry was published for an authentication bypass vulnerability in Borg SPM 2007 that allows unauthenticated remote attackers to log in as any user. The flaw was mapped to CWE-1390 and assigned a critical CVSS v3.1 vector indicating remote exploitation with no privileges or user interaction required.
A CVE entry was published for an arbitrary file upload vulnerability in Borg SPM 2007 that allows unauthenticated remote attackers to upload and execute web shell backdoors on the server. The issue was mapped to CWE-434 and assigned a critical CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
On April 23, 2026, twcert@cert.org.tw received reports for three critical vulnerabilities affecting Borg SPM 2007: an arbitrary file upload flaw, an authentication bypass, and a SQL injection issue. All three vulnerabilities can be exploited remotely without authentication and carry high confidentiality, integrity, and availability impact.
BorG Technology Corporation's Borg SPM 2007 product is noted in the advisories as having ended sales in 2008. This provides product lifecycle context for the later-disclosed vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of critical and high-severity vulnerabilities affecting a diverse set of software products were publicly disclosed in October 2025. Epsilon RH by Grupo Castilla was found to have a SQL injection vulnerability (CVE-2025-41028) that allows attackers to manipulate the database by sending crafted POST requests to the 'sEstadoUsr' parameter in the '/epsilonnetws/WSAvisos.asmx' endpoint. Lanscope Endpoint Manager (CVE-2025-61932) was reported to have an improper origin verification flaw, enabling attackers to execute arbitrary code via specially crafted packets, though remote exploitation is not possible. Galaxy Software Services Vitals ESP Forum Module (CVE-2025-31342) was discovered to allow remote authenticated users to upload dangerous files, leading to arbitrary command execution. Fsas Technologies Inc.'s ETERNUS SF (CVE-2025-62577) contains incorrect default permissions, allowing low-privileged users to obtain database credentials and potentially escalate privileges to execute OS commands as an administrator. Excellent Infotek's Document Management System (CVE-2025-11948) is vulnerable to unauthenticated arbitrary file upload, enabling attackers to deploy web shells and execute code on the server. Vvveb CMS up to version 1.0.5 is susceptible to authenticated code injection via its Code Editor, allowing attackers to modify files and achieve remote code execution. The Theme Editor plugin for WordPress (CVE-2025-9890) is vulnerable to cross-site request forgery, which can be exploited to achieve remote code execution if an administrator is tricked into clicking a malicious link. The PPOM plugin for WooCommerce (CVE-2025-11391) allows unauthenticated arbitrary file uploads, posing a severe risk to affected e-commerce sites. The Appointments plugin for WordPress (CVE-2017-20206) and the Flickr Gallery plugin (CVE-2017-20207) both suffer from unauthenticated PHP object injection vulnerabilities, which have been actively exploited to create backdoors using the WP_Theme() class. RegistrationMagic (CVE-2017-20208) is also affected by a PHP object injection flaw, allowing attackers to fetch and install remote files. Finally, BLU-IC2 and BLU-IC4 devices (CVE-2025-11925) have an API that returns an incorrect Content-Type header, potentially enabling HTML/JavaScript injection in responses. Each of these vulnerabilities presents a significant risk, with several allowing remote code execution, privilege escalation, or the installation of persistent backdoors. The affected products span web applications, content management systems, endpoint management tools, and specialized enterprise software. Security teams are advised to review the specific advisories, apply patches or mitigations where available, and monitor for signs of exploitation, as several vulnerabilities have been reported as actively exploited in the wild. The diversity and severity of these disclosures underscore the ongoing need for rigorous vulnerability management and timely response to public advisories.
Jun 29, 2026
TWCERT/CC published advisories for two high-severity enterprise software vulnerabilities that could let attackers compromise backend systems and data. **CVE-2026-5965** affects **NewSoftOA** from NewSoft and is an **OS command injection** flaw (`CWE-78`) that allows **unauthenticated remote attackers** to execute arbitrary operating system commands on the server. The issue carries a `CVSS v3.1` score with vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating low-complexity network exploitation with high impact across confidentiality, integrity, and availability. A second advisory, **CVE-2026-7489**, affects **Sunnet CTMS** and describes a **SQL injection** vulnerability (`CWE-89`) that allows **authenticated remote attackers** to run arbitrary SQL commands against the application database. Successful exploitation could enable reading, modifying, and deleting database contents, with a `CVSS v3.1` vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. Both vulnerabilities were published with English and Chinese references by TWCERT/CC, underscoring continued exposure in internet-reachable business applications to injection attacks that can lead to full server compromise or severe database manipulation.
Jun 29, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026