CVE-2026-3955

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in elecV2P up to 3.8.3. Affected by this issue is the function runJSFile of the file source-code/elecV2P-master/webser/wbjs.js of the component jsfile Endpoint. Such manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-395508.1Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a th CVE-2026-395518.1Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through CVE-2026-395528.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blu CVE-2026-395538.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveR CVE-2026-395548.1Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.CVE-2026-395558.1Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through CVE-2026-395568.1Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.CVE-2026-395578.1Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.CVE-2026-395588.1Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.CVE-2026-395598.1Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.CVE-2026-39564.7A vulnerability was detected in xierongwkhd weimai-wetapp up to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2. This affects the function getAdmin CVE-2026-395608.1Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.