CVE-2026-11944

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-119457.5PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicCVE-2026-119467.5An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GCVE-2026-11957.5A weakness has been identified in MineAdmin 1.x/2.x. This impacts the function refresh of the file /system/refresh of the component JWT TokeCVE-2026-119563.7A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the componentCVE-2026-119587.3Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker witCVE-2026-119596.9Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input CVE-2026-11965.3A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such mCVE-2026-119606.9Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log CVE-2026-119618.1The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registrCVE-2026-119628.8The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authCVE-2026-119638.1The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action andCVE-2026-119649.1The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook noti