PT-2026-36707 · Av Stumpfl · Pixera Two Media Server

Trebledj · Published 2026-05-03 · Updated 2026-05-03 · CVE-2026-7703

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AV Stumpfl Pixera Two Media Server versions prior to 25.2 R3

Description A flaw in the Websocket API component allows for remote code injection. This occurs through the manipulation of an unknown function within the API.

Recommendations Upgrade to version 25.2 R3.

Exploit

Fix

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

Related Identifiers

CVE-2026-7703

Affected Products

Pixera Two Media Server

References · 11

• 🔥 https://gist.github.com/TrebledJ/585a20525e45549f299d282233632608 · Exploit
• https://help.pixera.one/changelogs-version-overviews/pixera-252-overview-changelog · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7703 · Security Note
• https://t.me/CVEtracker/52582 · Telegram Post
• https://t.me/cveNotify/161939 · Telegram Post
• https://vuldb.com/vuln/360872 · Note
• https://vuldb.com/submit/805274 · Note
• https://twitter.com/infoflowcloud/status/2050992730222788619 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2050996527623991369 · Twitter Post
• https://vuldb.com/vuln/360872/cti · Note
• https://twitter.com/CVEnew/status/2050990518260121983 · Twitter Post