PT-2026-30409 · Unknown · Qingdaou Onlinejudge

Ana10Gy · Published 2026-04-05 · Updated 2026-04-05 · CVE-2026-5538

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QingdaoU OnlineJudge versions up to 1.6.1

Description A server-side request forgery condition exists in the JudgeServer.service url function of the judge server heartbeat endpoint within QingdaoU OnlineJudge. This manipulation can be exploited remotely. The vendor was contacted but did not respond.

Recommendations Update QingdaoU OnlineJudge to a version later than 1.6.1.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-5538

Affected Products

Qingdaou Onlinejudge

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-5538 · Security Note
• https://github.com/AnalogyC0de/public_exp/issues/27 · Note
• https://vuldb.com/submit/782203 · Note
• https://twitter.com/cyberbivash/status/2040667520672108634 · Twitter Post
• https://twitter.com/CVEarity/status/2040794790011560274 · Twitter Post
• https://vuldb.com/vuln/355291 · Note
• https://vuldb.com/vuln/355291/cti · Note