CVE-2026-1196

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such manipulation of the argument ID leads to information disclosure. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jan 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-119606.9Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log CVE-2026-119618.1The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registr CVE-2026-119628.8The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing auth CVE-2026-119638.1The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and CVE-2026-119649.1The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook noti CVE-2026-119656.5The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership su CVE-2026-119665.3The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of CVE-2026-119678.5MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located CVE-2026-119685.5Argument Injection in TortoiseGitBlame via Malicious Git History Filenames Leads to Arbitrary File Write in TortoiseGit CVE-2026-119694.9The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs[]' Parameter in all versions up CVE-2026-11973.1A vulnerability was detected in MineAdmin 1.x/2.x. Affected by this vulnerability is an unknown functionality of the file /system/downloadBy CVE-2026-119704.8This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E