PT-2026-28725 · Elecv2 · Elecv2

Zast.Ai · Published 2026-03-28 · Updated 2026-03-29 · CVE-2026-5011

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions elecV2 versions prior to 3.8.4

Description A code injection issue exists in the JSON Parser component due to manipulation of the rawcode argument within the runJSFile function of the /webhook file. Remote exploitation is possible. The project was informed of the issue but has not responded.

Recommendations Update to version 3.8.4 or later.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2026-5011

Affected Products

Elecv2

References · 7

• 🔥 https://github.com/elecV2/elecV2P/issues/195 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5011 · Security Note
• https://vuldb.com/submit/779173 · Note
• https://vuldb.com/vuln/353896/cti · Note
• https://vuldb.com/vuln/353896 · Note
• https://twitter.com/CVEnew/status/2038135166284251438 · Twitter Post
• https://github.com/elecV2/elecV2P · Note