PT-2026-145397
CVE-2026-126770
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 3.1
5.0
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾