CVE-2026-2560

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the function run of the file plugins/fileThumb/lib/VideoResize.class.php of the component Media File Preview Plugin. Such manipulation of the argument localFile leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-256006.4The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s e CVE-2026-256016.7A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryp CVE-2026-256022.3Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client t CVE-2026-256036.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that c CVE-2026-256045.4In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual insta CVE-2026-256057.1A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file deletion without prop CVE-2026-256068.7A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters al CVE-2026-256075.7Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with CVE-2026-256082.3STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain CVE-2026-256094.3Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.CVE-2026-25618.8A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdca CVE-2026-256106.5An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.