CVE-2026-6211

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc. WEOLL allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects WEOLL: from 2.0.9 before 3.2.45.33.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Jun 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-621106.5Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.CVE-2026-621116.5Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.CVE-2026-621127.6Editor SQL Injection in Amelia <= 2.4.9 versions.CVE-2026-621134.3Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.CVE-2026-621145.3Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.CVE-2026-621158.1Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.CVE-2026-621167.1Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.CVE-2026-621178.5Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.CVE-2026-621187.3Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.CVE-2026-62128.8Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc. TeraMIS allows Privilege Abuse. This CVE-2026-621209.8Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.CVE-2026-621239.8Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
CVE-2026-6211: High severity, CVSS 8.7 | Vulnix