Posted by disclosure via Fulldisclosure on Aug 06 0day Rubbish Research Team is publicly disclosing a vulnerability in Stimulsoft Server 2026.3.1 (Stimulsoft). The

research is published and a proof-of-concept is available.

Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication)

A default-configuration defect chain combines into a complete unauthenticated RCE. The /1/signup endpoint is open by

default with email activation disabled, so an anonymous attacker registers and immediately...