CVE-2026-1978

Katalog CVE

CVSS 7.5 · High EPSS 0,42%

Kerentanan Direct Request ('Forced Browsing') pada kalyan02 nanocms. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The exploit is now public and may be used. You should change the configuration settings.

Rincian

Terbit di NVD

6 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-425: Direct Request ('Forced Browsing')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.344500 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.743260 advisory pihak ketiga · vdb entry
• https://github.com/kalyan02/NanoCMS/ product
• https://github.com/kalyan02/NanoCMS/blob/master/data/pagesdata.txt product
• https://vuldb.com/?ctiid.344500 permissions required · vdb entry