rootpwn

medium · CVSS v3 5.6 · CVSS v4 6.3

CVE-2026-96745

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embe…

Description

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.

Scores

Severity
medium
CVSS v2
5.1
CVSS v3
5.6
CVSS v4
6.3
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-96892

A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-97058

sprintf-js 1.1.3 allows attackers to inject unbounded precision specifiers that trigger RangeError exceptions, causing application crashes. The flaw is triggered by malicious format strings and can be exploited in any Node.js or JavaScript environment that uses the library. It is a medium‑severity issue that can lead to denial of service.

View analysis

medium

CVE-2026-97061

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.

View analysis

medium

CVE-2026-97062

Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

View analysis