CVE-2026-112168

MediumCVSS 6.0/10Last modified Nov 12, 2026

Description

The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets.

Metrics

CVSS 4.0 6.0/10CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-261CWE-312CWE-327CWE-798

Affected software

VendorProductVersions
GALENO SISTEMIMAGISTRA3.12

References

Timeline

Published
Nov 9, 2026
Last modified
Nov 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1121696.1Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user accouCVE-2026-112176.5Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendCVE-2026-1121706.3The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.CVE-2026-1121714.4An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosuCVE-2026-1121728.1CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and executeCVE-2026-1121749.3Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface runninCVE-2026-1121777.3A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase CVE-2026-1121787.1MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or CVE-2026-1121795.3In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of nonCVE-2026-112186.8Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who convincCVE-2026-1121805.1MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed frCVE-2026-1121834.8MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, th
CVE-2026-112168: Medium severity, CVSS 6.0 | Vulnix