CVE-2026-30402

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Mar 19, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-304037.5There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, wCVE-2026-304047.5The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issueCVE-2026-304057.5An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attributeCVE-2026-30412.4A security vulnerability has been detected in xingfuggz BaykeShop up to 1.3.20. Impacted is an unknown function of the file src/baykeshop/coCVE-2026-30429.8A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/indCVE-2026-30436.1A flaw has been found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/navbar.phpCVE-2026-30448.8A vulnerability has been found in Tenda AC8 16.03.34.06. This affects the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of theCVE-2026-30457.5The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data CVE-2026-304526.5Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with lCVE-2026-304579.8An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.CVE-2026-304589.1An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.CVE-2026-304597.1An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset toke
CVE-2026-30402: Critical severity, CVSS 9.8 | Vulnix