Loading story…
Pentagrid reported that testing of Ergon's Airlock Web Application Firewall against portions of the OWASP Core Rule Set (CRS) regression suite found numerous payloads that Airlock allowed while CRS would normally block, spanning scanner detection, protocol enforcement, file inclusion, remote code execution, PHP injection, generic application attacks, SQL injection, and Java-related attack strings. The researchers also identified a PHP short-tag payload that bypassed both Airlock and CRS; after disclosure, CRS closed that detection gap, while Airlock still allowed the payload in the tested mid-2024 configuration and Ergon opened internal tickets to review the findings.
A second bypass highlighted a broader weakness in XML parsing: XSS payloads hidden in XML attribute values were not inspected by several CRS rules because they checked XML:/* text nodes but not XML://@* attributes. That gap aligns with CVE-2022-3442, a reflected XSS flaw Pentagrid disclosed in CREALOGIX's ebics.aspx endpoint, where attacker-controlled input in the EBICS Version field could be reflected into an HTML error response. CRS maintainers later fixed the XML-attribute false negative in v4.28.0 under GHSA-6jp8-c2w2-x7wr by extending coverage to XML attributes and adding regression tests, while CREALOGIX had already released patches and advised customers to update to version 7.1 or apply vendor fixes.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Pentagrid performed a white-box assessment of Ergon's Airlock WAF using parts of the OWASP CRS regression suite and found numerous payloads that Airlock allowed in the examined mid-2024 configuration across categories including SQL injection, RCE, file inclusion, scanner detection, and XSS-related cases. The testing also identified a PHP short-tag bypass affecting both Airlock and CRS, plus an XML-attribute XSS bypass affecting Airlock.
A GitHub issue documented that OWASP Core Rule Set rules failed to detect XSS payloads placed in XML attribute values because affected rules inspected XML text nodes but not attributes. The report showed the bypass worked across multiple rule families and at any paranoia level.
Pentagrid disclosed CVE-2022-3442 affecting CREALOGIX AG's EBICS banking server implementation at the ebics.aspx endpoint. CREALOGIX fixed the issue, released patched software, and advised customers to update to version 7.1 or apply provided patches.
In July 2026, maintainers said the XML attribute false negative was fixed in CRS main as of v4.28.0 via the security fix for GHSA-6jp8-c2w2-x7wr. The change added XML attribute inspection across multiple rule families and regression tests, causing the original proof of concept to be blocked.
Following discussions of Pentagrid's findings, Ergon opened internal tickets related to the identified Airlock WAF issues. The article presents this as the vendor's response to the reported bypasses.
After Pentagrid disclosed a PHP short-tag payload that bypassed both Airlock and CRS, OWASP CRS fixed its detection gap. In the tested Airlock setup described by Pentagrid, the same payload was still allowed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
pentagrid.ch
Open sourcegithub.com
Open sourcepentagrid.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple web application vulnerabilities have been disclosed, highlighting the risks associated with misconfigured APIs and file upload functionalities. One report demonstrates how a misconfigured GraphQL endpoint, which accepts `application/x-www-form-urlencoded` content types, can be exploited for Cross-Site Request Forgery (CSRF) attacks. Attackers can craft malicious HTML forms to submit GraphQL mutations, such as changing user email addresses, without proper user consent. Another case details a $100 bug bounty awarded for discovering XSS via malicious PDF uploads and input validation bypasses that led to denial-of-service conditions on a coding platform. Further research describes a blind XML External Entity (XXE) vulnerability in a "Check stock" feature, where attackers can trigger out-of-band DNS and HTTP requests using Burp Collaborator, confirming the presence of XXE. Additionally, a $1,500 bounty was awarded for exploiting an image upload feature at Rockstar Games, where a vulnerable ImageMagick instance enabled a chain of attacks including Local File Inclusion (LFI), Server-Side Request Forgery (SSRF), and remote file access via SMB paths. These incidents underscore the importance of strict input validation, secure API configurations, and careful handling of file uploads in web applications.
Jun 29, 2026
A series of critical and high-severity vulnerabilities affecting a diverse set of software products were publicly disclosed in October 2025. Epsilon RH by Grupo Castilla was found to have a SQL injection vulnerability (CVE-2025-41028) that allows attackers to manipulate the database by sending crafted POST requests to the 'sEstadoUsr' parameter in the '/epsilonnetws/WSAvisos.asmx' endpoint. Lanscope Endpoint Manager (CVE-2025-61932) was reported to have an improper origin verification flaw, enabling attackers to execute arbitrary code via specially crafted packets, though remote exploitation is not possible. Galaxy Software Services Vitals ESP Forum Module (CVE-2025-31342) was discovered to allow remote authenticated users to upload dangerous files, leading to arbitrary command execution. Fsas Technologies Inc.'s ETERNUS SF (CVE-2025-62577) contains incorrect default permissions, allowing low-privileged users to obtain database credentials and potentially escalate privileges to execute OS commands as an administrator. Excellent Infotek's Document Management System (CVE-2025-11948) is vulnerable to unauthenticated arbitrary file upload, enabling attackers to deploy web shells and execute code on the server. Vvveb CMS up to version 1.0.5 is susceptible to authenticated code injection via its Code Editor, allowing attackers to modify files and achieve remote code execution. The Theme Editor plugin for WordPress (CVE-2025-9890) is vulnerable to cross-site request forgery, which can be exploited to achieve remote code execution if an administrator is tricked into clicking a malicious link. The PPOM plugin for WooCommerce (CVE-2025-11391) allows unauthenticated arbitrary file uploads, posing a severe risk to affected e-commerce sites. The Appointments plugin for WordPress (CVE-2017-20206) and the Flickr Gallery plugin (CVE-2017-20207) both suffer from unauthenticated PHP object injection vulnerabilities, which have been actively exploited to create backdoors using the WP_Theme() class. RegistrationMagic (CVE-2017-20208) is also affected by a PHP object injection flaw, allowing attackers to fetch and install remote files. Finally, BLU-IC2 and BLU-IC4 devices (CVE-2025-11925) have an API that returns an incorrect Content-Type header, potentially enabling HTML/JavaScript injection in responses. Each of these vulnerabilities presents a significant risk, with several allowing remote code execution, privilege escalation, or the installation of persistent backdoors. The affected products span web applications, content management systems, endpoint management tools, and specialized enterprise software. Security teams are advised to review the specific advisories, apply patches or mitigations where available, and monitor for signs of exploitation, as several vulnerabilities have been reported as actively exploited in the wild. The diversity and severity of these disclosures underscore the ongoing need for rigorous vulnerability management and timely response to public advisories.
Jun 29, 2026
OWASP disclosed **CVE-2026-33691**, a vulnerability in the **Core Rule Set (CRS)** that lets attackers evade file upload extension checks by appending whitespace to filenames. The bypass can allow dangerous server-executable files such as `.php`, `.phar`, `.jsp`, and `.jspx` to be uploaded, creating a path to web shell deployment if the backend later normalizes or trims the filename before execution. The issue is considered most impactful on **Windows** backends, where trailing whitespace in filenames may be normalized automatically, while **Linux** systems are generally harder to exploit unless the application or web server explicitly trims names with functions such as `strip()` or `trim()`. OWASP patched the flaw in **CRS 3.3.9**, **4.25.x LTS**, and **4.8.x**, with fixes backported to supported branches; the vulnerability was reported by **RelunSec** (also known as **@HackingRepo** on GitHub).
Jun 29, 2026