PT-2026-28730 · Elecv2 · Elecv2

Zast.Ai · Publicado 2026-03-28 · Atualizado 2026-03-29 · CVE-2026-5016

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions elecV2 elecV2P versions through 3.8.3

Description A server-side request forgery condition exists due to manipulation of the req argument within the eAxios function located in the /mock file of the URL Handler component. This allows for remote attacks. The project was notified of the issue but has not yet responded. The exploit is publicly available.

Recommendations Versions prior to 3.8.4 should be updated. Consider temporarily disabling the eAxios function until a patch is available. Restrict access to the /mock file to minimize the risk of exploitation.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-5016

Produtos afetados

Elecv2

Referências · 7

• 🔥 https://github.com/elecV2/elecV2P/issues/202 · Exploit
• https://vuldb.com/vuln/353901/cti · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-5016 · Nota de Segurança
• https://twitter.com/CVEnew/status/2038135158856110242 · Publicação no Twitter
• https://vuldb.com/submit/779181 · Nota
• https://github.com/elecV2/elecV2P · Nota
• https://vuldb.com/vuln/353901 · Nota