PT-2026-2308 · Unknown · Weberpmesv2

Nedlir · Publicado 2026-01-12 · Atualizado 2026-01-21 · CVE-2026-22789

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebErpMesv2 versions prior to 1.19

Description WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions prior to 1.19 contain a file upload validation bypass in multiple controllers. This allows authenticated users to upload arbitrary files, including PHP scripts, potentially leading to Remote Code Execution (RCE). The issue is similar to another reported problem but exists in different code locations.

Recommendations Update to version 1.19 or later.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

CWE-616

Identificadores relacionados

CVE-2026-22789

GHSA-64RV-F829-X6M4

Produtos afetados

Weberpmesv2

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22789.json · Exploit
• 🔥 https://github.com/SMEWebify/WebErpMesv2/security/advisories/GHSA-64rv-f829-x6m4 · Exploit
• https://github.com/SMEWebify/WebErpMesv2/commit/c9e7f4a85aeb774a0ea4b61ad57a51b941166b69 · Correção
• https://osv.dev/vulnerability/CVE-2026-22789 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2010922038542713092 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22789 · Nota de Segurança
• https://t.me/cveNotify/149442 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2010838276996022601 · Publicação no Twitter