10 AI-discovered 0-day vulnerabilities with POCs: InterSystems IRIS, Acumatica, Brekke SIP Server RCE

Vulnerability Overview The project "Daily Rubyish" has released a comprehensive analysis of 10 zero-day vulnerabilities discovered by AI, including reproducible proof-of-concept (PoC) code. These vulnerabilities affect various enterprise products, with CVSS scores ranging from 7.3 to 9.8. Affected Products 1. InterSystems IRIS - FolderManager Property Injection RCE - Version: 2020.1.0.224.1 (Community Edition) - CVSS: 9.8 - Type: Unauthenticated Remote Code Execution 2. AdRem NetCrunch - Cross-Session Hijack RCE - Version: 16.0.0.8297 RC - CVSS: 9.8 - Type: Unauthenticated Remote Code Execution 3. Altus BluePlant - Hardcoded Credentials RCE - Version: 9.1.4b - CVSS: 9.8 - Type: Unauthenticated Remote Code Execution 4. Brekke SIP Server - Unauthenticated Nashorn JS Engine RCE - Version: v3.19.1.8p1 (Evaluation Edition) - CVSS: 9.8 - Type: Unauthenticated Remote Code Execution 5. Brekke SIP Server - Unauthenticated Zip Slip Webshell RCE - Version: v3.19.1.8p1 (Evaluation Edition) - CVSS: 9.8 - Type: Unauthenticated Remote Code Execution 6. DataSunrise Suite - Email Verification Code Brute Force RCE - Version: 11.2.17.12020 - CVSS: 9.8 - Type: Unauthenticated Remote Code Execution 7. Brekke SIP Server - Authentication Fail-Open Primitive - Version: v3.19.1.8p1 (Evaluation Edition) - CVSS: 9.1 - Type: Authentication bypass resulting in 23 unauthenticated beans being exposed 8. Acumatica ERP - Customization Publish Webshell RCE - Version: 2020 R1 (build 20.101.0225) - CVSS: 8.8 - Type: Unauthenticated Remote Code Execution 9. AdRem NetCrunch - Startup Script RCE - Version: 16.0.0.8297 RC - CVSS: 8.8 - Type: Unauthenticated Remote Code Execution 10. Altus IX Developer - XAML Deserialization RCE - Version: 2.53.65422 - CVSS: 7.3 - Type: Local/User Interaction Remote Code Execution Remediation For detailed remediation steps for each vulnerability, please refer to the following links: 1. InterSystems IRIS 2. AdRem NetCrunch 3. Altus BluePlant 4. Brekke SIP Server 5. Brekke SIP Server 6. DataSunrise Suite 7. Brekke SIP Server 8. Acumatica ERP 9. AdRem NetCrunch 10. Altus IX Developer PoC Code PoC code is not provided directly on the page; however, detailed exploitation steps and links are provided. Specific exploitation code can be obtained via the links above.

Goal Reached Thanks to every supporter — we hit 100%!

10 AI-discovered 0-day vulnerabilities with POCs: InterSystems IRIS, Acumatica, Brekke SIP Server RCE