Security1 hOctober 27, 2026, 11:00

erxes: 3,394 title hits and a 9.8 auth bypass that outlived its patch

ZoomEye counts 3,394 pages with erxes in the title and 52 hosts matched by fingerprint. A 2025 audit found a 9.8 authentication bypass via a forged User header plus two path traversal flaws in versions below 1.6.2.

DEV Community

Open source

erxes: 3,394 title hits and a 9.8 auth bypass that outlived its patch

ZoomEye: 3,394 title matches versus 52 app-fingerprint hosts
CVE-2024-57190 (9.8): auth bypass via forged User header
CVE-2024-57186 and 57189 (5.4): arbitrary file read and write
Fixes landed in 1.6.1 and 1.6.2, but plugins patch separately

#Erxes#ZoomEye

Four WordPress plugins hit by CVSS 9.8 auth bypass flaws

Security

Cisco warns of active exploitation of CVSS 9.8 SD-WAN Manager auth bypass

Security

Cockpit 9.8 injection flaw: 6,767 fingerprints, 10,146 title matches

Security

erxes: 3,394 title hits and a 9.8 auth bypass that outlived its patch

Four WordPress plugins hit by CVSS 9.8 auth bypass flaws

Cisco warns of active exploitation of CVSS 9.8 SD-WAN Manager auth bypass

Cockpit 9.8 injection flaw: 6,767 fingerprints, 10,146 title matches

HPE patches 72 ArubaOS flaws, including eight max-severity RCE and auth bypass bugs