Silent Lynx Exploitat WinRAR Vitium ad Instruendum Reverse Shell in Attacis Regni CIS · 4h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 7h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 7h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 8h Vulnerabilitas in software Sparx Systems Enterprise Architect · 8h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 8h Vulnerabilitates in Slican telephonis · 9h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 12h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 13h Langflow's Critica Authenticated RCE Vulnerabilitas Targetata in 1,423 Honeypot Exploit Conatibus · 13h Silent Lynx Exploitat WinRAR Vitium ad Instruendum Reverse Shell in Attacis Regni CIS · 4h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 7h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 7h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 8h Vulnerabilitas in software Sparx Systems Enterprise Architect · 8h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 8h Vulnerabilitates in Slican telephonis · 9h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 12h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 13h Langflow's Critica Authenticated RCE Vulnerabilitas Targetata in 1,423 Honeypot Exploit Conatibus · 13h

ACyber Sentinel Turma Aestimationis Securitatis

← Redire

⚠️ Renuntiatio Vulnerabilitatis

CVE-2026-85520

CRITICAL CVSS 9.3 CVSS 4.0 📌 Deferred

CVE-2026-85520 - Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module

Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and content through request parameters. Due to the lack of authentication and input validation, the request is processed successfully, allowing an attacker to write and execute arbitrary PHP code, resulting in remote code execution (RCE).

This issue was fixed in version 2.3.9.

Publicatum: Sep 29, 2026 12:17

Ultima Mutatio: Sep 30, 2026 19:57