CVE Watch6 oct 2026

CVE-2026-105610

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blad

CVSS

4.7

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 6 oct 2026 · Última mod.: 6 oct 2026 · CWE-266 · CWE-285

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument initPassword results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-955948.1 ALT

—

———Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.0 versions.5h CVE-2026-481977.2 ALT

—

———Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.5h CVE-2026-397758.8 ALT

—

———Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.5h CVE-2026-397748.8 ALT

—

———Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.5h CVE-2026-3977310.0 CRÍ

—

———Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.5h CVE-2026-397657.2 ALT

—

———Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.5h