CVE-2026-2184

Katalog CVE

CVSS 9.8 · Critical EPSS 10,7%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada greatdevelopers certificate. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerability affects unknown code of the file /restructured/csv.php. The manipulation of the argument photo results in os command injection. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The code repository of the project has not been active for many years.

Rincian

Terbit di NVD

8 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

10,7% peluang dieksploitasi; lebih tinggi dari 95,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lakshayyverma/CVE-Discovery/blob/main/Certificate2.md exploit · advisory pihak ketiga
• https://vuldb.com/?id.344887 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.749714 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.344887 permissions required · vdb entry