DataSunrise Suite: Unauthenticated RCE via Email Verification-Code Brute Force

Four independent defects in DataSunrise Suite's forgotten-password flow — code generation decoupled from delivery, an unenforced TTL, no rate limiting, and an in-memory flag trusted over DB state — combine into an unauthenticated RCE via runShellAction -> execvp.