CVE-2026-4200

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-420008.6Insufficient Validation of Names During AXFR CVE-2026-420017.5Insufficient Validation of Autoprimary SOA Queries CVE-2026-420027.5Concurrency and locking defects in GSS-TSIG CVE-2026-420043.7An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT recor CVE-2026-420054.3An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The CVE-2026-420064.3An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking on CVE-2026-420079.1An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing CVE-2026-420084.3Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a va CVE-2026-420097.5A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic CVE-2026-42017.3A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function U CVE-2026-420109.8A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing CVE-2026-420117.4A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate