CVE-2026-22898

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to gain access to the system.

We have already fixed the vulnerability in the following version: QVR Pro 2.7.4.14 and later

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Mar 20, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-228996.5A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can theCVE-2026-22903.8The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This CVE-2026-229009.8A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerabiliCVE-2026-229019.8A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit CVE-2026-229026.7A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can thenCVE-2026-229039.8An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffCVE-2026-229049.8Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversizedCVE-2026-229057.5An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (eCVE-2026-229069.8User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration fiCVE-2026-229079.1An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.CVE-2026-229089.1Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity CVE-2026-229099.1Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications,