[0day-rubbish] RCDevs WebADM 2.4.14 authenticated log viewer sid command injection to webadm uid 999 code execution (7.2)

Reported by Full Disclosure

Summary by Cyber Security News6 Oct 2026, 19:44 CET

About this summary. This is a short excerpt from the description that Full Disclosure published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/fulldisclosure/2026/Oct/7

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in RCDevs WebADM 2.4.14, Freeware Edition, the closed-source IAM/MFA management platform from RCDevs Security SA (Luxembourg) that fronts the vendor's OpenOTP, SpanKey and TiQR authentication products. Type: OS command injection (CWE-78, with CWE-20 and CWE-116 contributing, and CWE-732/CWE-276 and CWE-250 added for two auxiliary conditions).

Read the full article at Full Disclosure →

Source attribution: headline and facts are from Full Disclosure (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.