First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-25615

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Blesta	Blesta	>= 3.0.0, < 5.13.3

References

https://www.blesta.com/2026/01/28/security-advisory/Vendor Advisory
http://seclists.org/fulldisclosure/2026/Feb/1Mailing List, Third Party Advisory

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-256166.1Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.CVE-2026-25628.8A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This impacts the function cast_streen of the file /jdcapi CVE-2026-256206.0An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - CVE-2026-256216.0A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to i CVE-2026-256226.0A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (N CVE-2026-256236.0An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next CVE-2026-256244.8An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Managemen CVE-2026-256277.5NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSocket transport can be CVE-2026-256288.8Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files vi CVE-2026-25638.8A vulnerability was identified in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. Affected is the function set_stcreenen_deabled_status/get_CVE-2026-256316.5n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain CVE-2026-2563210.0EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks.