0day Rubbish Research Team discloses three unauthenticated file-upload RCE flaws (CVSS 9.8) in PrizmDoc for Java, Ecava IntegraXor IGX, and LCDS Laquis SCADA
First merged summary for this story; consolidates the initial three-report disclosure batch published by 0day Rubbish Research Team on 2026-09-22.
Three near-simultaneous Full Disclosure posts on 2026-09-22 from 0day Rubbish Research Team describe unauthenticated file-upload chains leading to code execution — as root on a PrizmDoc host, as Administrator on an IntegraXor SCADA HMI, and as native code in…
On 2026-09-22, the 0day Rubbish Research Team posted three disclosures to the Full Disclosure list (timestamps 18:31:14–18:31:19 UTC), all describing unauthenticated file-upload flaws that lead to code execution, each scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). In PrizmDoc for Java (VirtualViewer) 5.22.1, the uploadDocument function writes into the web application root, enabling a JSP webshell that runs with the JVM's privileges — uid 0 (root) in the deployment the researchers verified (CWE-306). In Ecava IntegraXor IGX 16.0.701.10 Web SCADA HMI, an unauthenticated /FileUpload write is chained to the dxmanager cmd.exe sink, yielding arbitrary command execution as Administrator (CWE-306). In LCDS Laquis SCADA, an unauthenticated file write at /uploade.html is chained with autoloading of CMDEXT*.DLL files, executing arbitrary native code in the SCADA web/HMI process, which also hosts the Modbus TCP listener; the default configuration ships with no password (CWE-434; no product version was stated for Laquis). All three posts advertise reproducible proofs-of-concept or full technical analyses, and none cite a CVE identifier or confirmed exploitation in the wild.
- Discloser: 0day Rubbish Research Team; three posts to the Full Disclosure list on 2026-09-22 between 18:31:14 and 18:31:19 UTC.
- All three flaws are unauthenticated file-upload issues scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), each with a claimed public reproducible PoC or full analysis.
- PrizmDoc for Java (VirtualViewer) 5.22.1: unauthenticated uploadDocument writes into the web application root; resulting JSP webshell runs with JVM privileges, observed as uid 0 (root) in the researchers' verified deployment; CWE-306.
- Ecava IntegraXor IGX 16.0.701.10 Web SCADA HMI: unauthenticated /FileUpload write chained to the dxmanager cmd.exe sink for arbitrary command execution as Administrator; CWE-306.
- LCDS Laquis SCADA: unauthenticated file write via /uploade.html chained with CMDEXT*.DLL autoload for native code execution in the SCADA web/HMI process, which also hosts the Modbus TCP listener; default configuration has no password;…
- CWE classification differs across the posts: CWE-306 for the PrizmDoc and IntegraXor flaws, CWE-434 for the Laquis flaw.
- No CVE identifiers are cited for any of the three flaws, and no in-the-wild exploitation is reported.
- Organizations
- 0day Rubbish Research Team
Coverage
oldest first · one row per article · UTC- · Sep 22, 2026
Full DisclosureFirst report
[0day-rubbish] PrizmDoc for Java (VirtualViewer) 5.22.1 Unauthenticated uploadDocument write into the webapp root to JSP webshell (9.8)
Unauthenticated upload in PrizmDoc for Java 5.22.1 writes a JSP webshell into the webapp root as root.
- · Sep 22, 2026
[0day-rubbish] Ecava IntegraXor IGX 16.0.701.10 Unauthenticated /FileUpload write chained to the dxmanager cmd.exe sink (9.8)
Unauthenticated file upload in Ecava IntegraXor IGX 16.0.701.10 chains to cmd.exe for Administrator code execution.
- · Sep 22, 2026
[0day-rubbish] LCDS Laquis SCADA Unauthenticated /uploade.html file write chained with CMDEXT*.DLL autoload (9.8)
Unauthenticated file upload in LCDS Laquis SCADA chains with DLL autoload for code execution, CVSS 9.8.