PT-2026-22273

CVE-2026-23702

Published

2026-02-27

Updated

2026-03-04

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWEB Pro versions prior to 1.12.1

Description A flaw exists that allows a logged-in attacker to execute code on the system. This is possible by submitting crafted input into the username field of the import preconfiguration action via the API V1 route. The affected API endpoint is '/api/V1'. The vulnerable parameter is username.

Recommendations Update to a version newer than 1.12.1.

Exploitability

Fix

Impacts

Researchers

Amir Zaltzman

Noam Moshe

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers