PT-2026-30409 · Unknown · Qingdaou Onlinejudge

Ana10Gy · Publicado 2026-04-05 · Atualizado 2026-04-05 · CVE-2026-5538

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QingdaoU OnlineJudge versions up to 1.6.1

Description A server-side request forgery condition exists in the JudgeServer.service url function of the judge server heartbeat endpoint within QingdaoU OnlineJudge. This manipulation can be exploited remotely. The vendor was contacted but did not respond.

Recommendations Update QingdaoU OnlineJudge to a version later than 1.6.1.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-5538

Produtos afetados

Qingdaou Onlinejudge

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-5538 · Nota de Segurança
• https://github.com/AnalogyC0de/public_exp/issues/27 · Nota
• https://vuldb.com/submit/782203 · Nota
• https://twitter.com/cyberbivash/status/2040667520672108634 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2040794790011560274 · Publicação no Twitter
• https://vuldb.com/vuln/355291 · Nota
• https://vuldb.com/vuln/355291/cti · Nota