0day Rubbish Research Team discloses three unauthenticated file-upload RCE flaws (CVSS 9.8) in PrizmDoc for Java, Ecava IntegraXor IGX, and LCDS Laquis SCADA

Three near-simultaneous Full Disclosure posts on 2026-09-22 from 0day Rubbish Research Team describe unauthenticated file-upload chains leading to code execution — as root on a PrizmDoc host, as Administrator on an IntegraXor SCADA HMI, and as native code in…

On 2026-09-22, the 0day Rubbish Research Team posted three disclosures to the Full Disclosure list (timestamps 18:31:14–18:31:19 UTC), all describing unauthenticated file-upload flaws that lead to code execution, each scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). In PrizmDoc for Java (VirtualViewer) 5.22.1, the uploadDocument function writes into the web application root, enabling a JSP webshell that runs with the JVM's privileges — uid 0 (root) in the deployment the researchers verified (CWE-306). In Ecava IntegraXor IGX 16.0.701.10 Web SCADA HMI, an unauthenticated /FileUpload write is chained to the dxmanager cmd.exe sink, yielding arbitrary command execution as Administrator (CWE-306). In LCDS Laquis SCADA, an unauthenticated file write at /uploade.html is chained with autoloading of CMDEXT*.DLL files, executing arbitrary native code in the SCADA web/HMI process, which also hosts the Modbus TCP listener; the default configuration ships with no password (CWE-434; no product version was stated for Laquis). All three posts advertise reproducible proofs-of-concept or full technical analyses, and none cite a CVE identifier or confirmed exploitation in the wild.

• Discloser: 0day Rubbish Research Team; three posts to the Full Disclosure list on 2026-09-22 between 18:31:14 and 18:31:19 UTC.
• All three flaws are unauthenticated file-upload issues scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), each with a claimed public reproducible PoC or full analysis.
• PrizmDoc for Java (VirtualViewer) 5.22.1: unauthenticated uploadDocument writes into the web application root; resulting JSP webshell runs with JVM privileges, observed as uid 0 (root) in the researchers' verified deployment; CWE-306.
• Ecava IntegraXor IGX 16.0.701.10 Web SCADA HMI: unauthenticated /FileUpload write chained to the dxmanager cmd.exe sink for arbitrary command execution as Administrator; CWE-306.
• LCDS Laquis SCADA: unauthenticated file write via /uploade.html chained with CMDEXT*.DLL autoload for native code execution in the SCADA web/HMI process, which also hosts the Modbus TCP listener; default configuration has no password;…
• CWE classification differs across the posts: CWE-306 for the PrizmDoc and IntegraXor flaws, CWE-434 for the Laquis flaw.
• No CVE identifiers are cited for any of the three flaws, and no in-the-wild exploitation is reported.