PT-2026-28725 · Elecv2 · Elecv2

Zast.Ai · Publicado 2026-03-28 · Atualizado 2026-03-29 · CVE-2026-5011

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions elecV2 versions prior to 3.8.4

Description A code injection issue exists in the JSON Parser component due to manipulation of the rawcode argument within the runJSFile function of the /webhook file. Remote exploitation is possible. The project was informed of the issue but has not responded.

Recommendations Update to version 3.8.4 or later.

Exploit

Correção

Special Elements Injection

Code Injection

Enumeração de Fraquezas

CWE-74

CWE-94

Identificadores relacionados

CVE-2026-5011

Produtos afetados

Elecv2

Referências · 7

• 🔥 https://github.com/elecV2/elecV2P/issues/195 · Exploit
• https://vuldb.com/submit/779173 · Nota
• https://vuldb.com/vuln/353896/cti · Nota
• https://vuldb.com/vuln/353896 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-5011 · Nota de Segurança
• https://twitter.com/CVEnew/status/2038135166284251438 · Publicação no Twitter
• https://github.com/elecV2/elecV2P · Nota