Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Two 0day Rubbish disclosures: Abyss X1 and Maian Guardian

1 source · 2 articlesFirst reported Updated ()2
What's new

First coverage.

Merged summary · grok-4.7-build · rewritten as coverage arrivesSummaries by Vani AI

Researchers disclosed an Abyss Web Server X1 2.16.22.0 pre-password command-execution chain and a Maian Guardian 2.1 projid injection, with no CVEs.

On 2026-10-15 the 0day Rubbish Research Team published two separate vulnerability disclosures; neither names a CVE or reports exploitation in the wild. The first concerns Aprelium’s free Abyss Web Server X1 2.16.22.0, which the post calls the vendor’s current official release. Before an administrator sets a console password, a client admitted by the shipped configuration can take over console credentials, write configuration, and reach command execution by treating logs as CGI; the disclosure rates that chain 7.5. The second is an OS command injection in the projid parameter of the Maian Guardian 2.1 license generator, a closed-source PHP licensing system from UK vendor Maian Script World. Researchers say the issue was verified end to end on a real installation, can execute commands as www-data (uid 33), is scored 7.2 with privileges required high, and cites CWE-78. The reports do not disagree; they cover different products disclosed by the same team.

Key facts
  • On 2026-10-15 the 0day Rubbish Research Team publicly disclosed two issues; neither report names a CVE or observed in-the-wild exploitation.
  • Aprelium Abyss Web Server X1 2.16.22.0, described as the vendor’s current official release, is affected from first start until an administrator sets a console password.
  • The Abyss chain is described as console credential takeover, configuration write, and command execution by treating logs as CGI, rated 7.5.
  • Maian Guardian 2.1, a closed-source PHP licensing system from UK vendor Maian Script World, has an OS command injection in the license generator projid parameter (CWE-78).
  • That injection was verified end to end on a real installation and can run commands as www-data (uid 33), scored 7.2 with privileges required high.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
ApreliumMaian Script World
Products
Abyss Web Server X1Maian Guardian
Organizations
0day Rubbish Research TeamMaian Script World
Countries
TunisiaUnited Kingdom

Coverage

oldest first · one row per article · UTC
  1. · 27d ago Full DisclosureFirst report

    [0day-rubbish] Abyss Web Server X1 2.16.22.0 first-run console credential takeover to configuration-write log-as-CGI command execution (7.5)

    Researchers disclosed a command-execution chain in Aprelium Abyss Web Server X1 2.16.22.0 before console password setup.

  2. · 27d ago Full Disclosure

    [0day-rubbish] Maian Guardian 2.1 license generator projid command injection to www-data uid 33 code execution (7.2, PR:H)

    Maian Guardian 2.1 license generator has a command injection that runs code as www-data.