PT-2026-28730 · Elecv2 · Elecv2

Zast.Ai · Published 2026-03-28 · Updated 2026-03-29 · CVE-2026-5016

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions elecV2 elecV2P versions through 3.8.3

Description A server-side request forgery condition exists due to manipulation of the req argument within the eAxios function located in the /mock file of the URL Handler component. This allows for remote attacks. The project was notified of the issue but has not yet responded. The exploit is publicly available.

Recommendations Versions prior to 3.8.4 should be updated. Consider temporarily disabling the eAxios function until a patch is available. Restrict access to the /mock file to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-5016

Affected Products

Elecv2

References · 7

• 🔥 https://github.com/elecV2/elecV2P/issues/202 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5016 · Security Note
• https://vuldb.com/vuln/353901/cti · Note
• https://twitter.com/CVEnew/status/2038135158856110242 · Twitter Post
• https://vuldb.com/submit/779181 · Note
• https://github.com/elecV2/elecV2P · Note
• https://vuldb.com/vuln/353901 · Note