CVE-2026-27760

HighCVSS 8.1/10Last modified Jul 14, 2026

Description

OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter. Attackers can break out of the define() string context in config.php using a single quote and statement separator to inject malicious PHP code that persists and executes on every subsequent page load when the installation wizard remains incomplete.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2026
Last modified: Jul 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-277614.3Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API access token scope checks, exposing pri CVE-2026-277648.6The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the sa CVE-2026-277655.5Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Application CVE-2026-277665.5in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak.CVE-2026-277679.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate CVE-2026-277686.6SQL Injection affecting the Access Manager role.CVE-2026-277692.7Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows CVE-2026-27779.8Privilege escalation in the Messaging System component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, CVE-2026-277706.5Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-277718.2Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or CVE-2026-277729.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate CVE-2026-277735.3Charging station authentication identifiers are publicly accessible via web-based mapping platforms.