PT-2026-7814 · Jung · Jung Smart Visu Server

Gjoko Krstic · Publicado 2026-02-12 · Atualizado 2026-02-20 · CVE-2026-26234

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JUNG Smart Visu Server version 1.1.1050

Description JUNG Smart Visu Server version 1.1.1050 contains a request header manipulation issue that allows unauthenticated attackers to override request URLs by injecting arbitrary values into the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, potentially leading to cache poisoning, phishing, and redirection of users to malicious domains. The vulnerability involves improper neutralization of HTTP headers for scripting syntax.

Recommendations Restrict access to the X-Forwarded-Host header to prevent manipulation.

Exploit

Correção

Enumeração de Fraquezas

CWE-644

Identificadores relacionados

CVE-2026-26234

Produtos afetados

Jung Smart Visu Server

Referências · 10

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2026-5970.php · Exploit
• https://vulncheck.com/advisories/jung-smart-visu-server-improper-neutralization-of-http-headers-for-scripting-syntax · Nota
• https://twitter.com/CVEnew/status/2021799448175870209 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2021936142417862873 · Publicação no Twitter
• https://t.me/CVEtracker/44501 · Publicação no Telegram
• https://t.me/cveNotify/152585 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-26234 · Nota de Segurança
• https://twitter.com/offseq/status/2021909719128883632 · Publicação no Twitter
• https://t.me/cveNotify/151803 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-26234 · Aviso do Fabricante