CVE Watch13 jul 2026

CVE-2026-12257

Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/i

CVSS

—

Sin CVSS

EPSS

0.4%

p33

KEV

—

Exploit Today

0-100

Publicado: 13 jul 2026 · Última mod.: 13 jul 2026 · CWE-94

EPSS · 30d

0.4%EPSS · 30 días0.4%

2026-07-142026-07-20

Descripción técnica

Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitised before being processed by the ColdFusion engine. As a result, a remote attacker could exploit this vulnerability to inject and execute arbitrary CFML (ColdFusion Markup Language) expressions and instantiate malicious Java objects, thereby compromising the system’s security.

Referencias oficiales

www.incibe.eshttps://www.incibe.es/en/incibe-cert/notices/aviso/remote-code-execution-mura-softwares-cms

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-32489.8 CRÍ

100.0%

KEV—80Langflow Missing Authentication Vulnerability6d CVE-2026-341978.8 ALT

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability6d CVE-2026-154107.2 ALT

71.2%

KEV—71SonicWall SMA1000 Appliances Code Injection Vulnerability5d CVE-2025-670389.8 CRÍ

55.4%

KEV—67Lantronix EDS5000 Code Injection Vulnerability15d CVE-2021-416539.8 CRÍ

99.5%

——30The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.12d CVE-2023-362558.8 ALT

99.0%

——30An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.12d