CVE-2026-34906

CriticalCVSS 9.3/10Last modified Jul 22, 2026

Description

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell.

This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-1336

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-349075.1Wirtualna Uczelnia is vulnerable to Reflected Cross‑Site Scripting (XSS) due to insecure handling of the locale parameter across multiple en CVE-2026-3490810.0A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauth CVE-2026-3490910.0A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the u CVE-2026-3491010.0A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a CVE-2026-349117.7A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to ac CVE-2026-349124.3A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and CVE-2026-349134.3A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earl CVE-2026-349148.3A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploi CVE-2026-349156.1A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t CVE-2026-349168.8A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t CVE-2026-349174.3Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrict CVE-2026-34926.4The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is