PT-2026-7814 · Jung · Jung Smart Visu Server

Gjoko Krstic · Published 2026-02-12 · Updated 2026-02-20 · CVE-2026-26234

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JUNG Smart Visu Server version 1.1.1050

Description JUNG Smart Visu Server version 1.1.1050 contains a request header manipulation issue that allows unauthenticated attackers to override request URLs by injecting arbitrary values into the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, potentially leading to cache poisoning, phishing, and redirection of users to malicious domains. The vulnerability involves improper neutralization of HTTP headers for scripting syntax.

Recommendations Restrict access to the X-Forwarded-Host header to prevent manipulation.

Exploit

Fix

Weakness Enumeration

CWE-644

Related Identifiers

CVE-2026-26234

Affected Products

Jung Smart Visu Server

References · 10

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2026-5970.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26234 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26234 · Vendor Advisory
• https://vulncheck.com/advisories/jung-smart-visu-server-improper-neutralization-of-http-headers-for-scripting-syntax · Note
• https://twitter.com/CVEnew/status/2021799448175870209 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2021936142417862873 · Twitter Post
• https://t.me/CVEtracker/44501 · Telegram Post
• https://t.me/cveNotify/152585 · Telegram Post
• https://twitter.com/offseq/status/2021909719128883632 · Twitter Post
• https://t.me/cveNotify/151803 · Telegram Post