PT-2026-36092 · Unknown · Lobster Pro

Marcelo Reyes · CVE-2024-13971 · Published 2026-04-30 · Updated 2026-05-29

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/S:N/AU:Y/V:C

Name of the Vulnerable Software and Affected Versions Lobster pro versions prior to 4.12.6-GA

Description Unauthenticated attackers can exploit a weakness in the XML parser functionality. This allows for read access to files on the application server and adjacent network shares, as well as the ability to perform HTTP GET requests to arbitrary services.

Recommendations Update to version 4.12.6-GA or later.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-13971

Affected Products

Lobster Pro

References · 8

• 🔥 https://schutzwerk.com/en/blog/schutzwerk-sa-2024-005 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-13971 · Security Note
• https://t.me/cveNotify/163797 · Telegram Post
• https://twitter.com/CVEnew/status/2049872432819843195 · Twitter Post
• https://t.me/CVEtracker/52311 · Telegram Post
• http://seclists.org/fulldisclosure/2026/May/1 · Note
• https://twitter.com/infoflowcloud/status/2049874198093267305 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2060165577881067984 · Twitter Post