PT-2026-22274

CVE-2026-24452

Published

2026-02-27

Updated

2026-03-04

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XWEB Pro versions prior to 1.12.1

Description An operating system command injection issue exists in XWEB Pro, allowing an authenticated attacker to execute code remotely on the system. This is achieved by providing a manipulated template file to the /devices route. The template file is the source of the injection.

Recommendations Update to a version later than 1.12.1.

Exploitability

Fix

Impacts

Researchers

Amir Zaltzman

Noam Moshe

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers