rootpwn

high · CVSS v3 7.3 · CVSS v4 6.9 · EPSS 0.00424

CVE-2026-96898

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality…

Description

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
0.00424

← All CVEs

Related CVEs

high

CVE-2026-96751

pmTicket Project-Management-Software is vulnerable to remote SQL injection via the setSync function in add_project.php. Attackers can manipulate the conn_settings argument to execute arbitrary SQL, potentially exposing or altering sensitive data.

View analysis

high

CVE-2026-96762

kvcache-ai mooncake up to 0.3.12/0.3.13.post1 has an authorization bypass in the UnmountSegment RPC Path Handler. Attackers can manipulate client_id/segment_id to gain unauthorized access. Remote exploitation is possible.

View analysis

high

CVE-2026-96803

A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the component fallBack API Endpoint. Such manipulation of the argument fallBackSql leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis

high

CVE-2026-96884

A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

View analysis