rootpwn

critical · CVSS v3 9.9 · EPSS 0.00464

CVE-2026-93698

CVE-2026-93698 exposes the Multilang adminbin to arbitrary command execution due to insufficient input validation. Attackers can run any sys

Overview

CVE-2026-93698 exposes the Multilang adminbin to arbitrary command execution due to insufficient input validation. Attackers can run any system command via the admin interface, potentially compromising the entire host. This flaw is critical and can be exploited remotely by authenticated or unauthenticated users with admin access.

Description

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Impact

The vulnerability allows attackers to compromise confidentiality, integrity, and availability of the affected system. Administrators and operators are directly impacted as they can be coerced into executing malicious commands. The flaw can lead to full system takeover, data exfiltration, and service disruption.

Remediation

Apply the vendor’s security patch that validates adminbin input or upgrade to the latest version. Restrict adminbin access to trusted IP ranges and enforce least privilege. Disable remote execution features if not required, and monitor logs for suspicious command activity.

Risk context

Severity is critical with a CVSS v3 score of 9.9. The EPSS score of 0.00464 indicates a low probability of exploitation, but the high impact warrants immediate attention. Defenders should prioritize patching and hardening.

Affected products

  • Multilang adminbin

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
—
EPSS
0.00464

arbitrary-command-execution adminbin critical input-validation privilege-escalation remote-execution

← All CVEs

Related CVEs

critical

CVE-2026-104414

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

View analysis

critical

CVE-2026-94298

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

View analysis

critical

CVE-2026-95102

CVE-2026-95102 exposes WebSocket endpoints in charging station systems that lack authentication, allowing attackers to impersonate stations. This flaw can lead to unauthorized data access and control over charging operations. The vulnerability is rated critical with a CVSS v3 score of 9.4.

View analysis

critical

CVE-2026-97637

The WordPress JSON API Auth plugin (up to 3.1.2) caches responses without considering HTTP method or POST body, allowing unauthenticated users to retrieve a live admin session cookie from the generate_auth_cookie endpoint. This exposes a valid Administrator logged_in cookie that can be used to impersonate the site admin. The flaw requires the PI-Media/json-api parent plugin to be active and an admin to have posted to the endpoint within the 24‑hour cache TTL.

View analysis