CVE-2026-5031

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_route=settings/users-view/ of the component Endpoint. The manipulation of the argument ID results in improper control of resource identifiers. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-99

Affected software

No affected versions have been published.

Timeline

Published
Mar 29, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-503104.7Integer overflow or wraparound in Windows Devices Human Interface allows an authorized attacker to disclose information locally.CVE-2026-503117.8Improper access control in Windows Server allows an authorized attacker to elevate privileges locally.CVE-2026-503127.8Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-503137.8Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.CVE-2026-503147.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-503157.8Null pointer dereference in Windows Image Acquisition allows an authorized attacker to elevate privileges locally.CVE-2026-503165.5Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.CVE-2026-503177.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Operating Systems allows an authorizeCVE-2026-503187.8Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.CVE-2026-50327.5The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to thCVE-2026-503217.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacCVE-2026-503227.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker
CVE-2026-5031: Medium severity, CVSS 4.3 | Vulnix