| TVN ID | TVN-202608010 |
|---|---|
| CVE ID | CVE-2026-80235, CVE-2026-80236, CVE-2026-80237 |
| CVSS | 【CVE-2026-80235】 9.8 (Critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 【CVE-2026-80236】 8.2 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N 【CVE-2026-80237】 8.8 (High) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Affected Products | EFence version 1.2.66 DB Ver:56 and earlier |
| Description | 【CVE-2026-80235(Arbitrary File Upload)】 Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. 【CVE-2026-80236(SQL Injection)】 Unauthenticated remote attackers can access file upload functionality and read database contents. 【CVE-2026-80237(Arbitrary File Upload)】 Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. |
| Solution | Please update to version 1.2.67 DB Ver:57 or later |
| Credit | Sideman (DEVCORE)、Linwz(DEVCORE) |
| Public Date | 2026-08-26 |
:::