CVE-2026-7673

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A vulnerability was detected in crmeb_java up to 1.3.4. This vulnerability affects unknown code of the file crmeb/crmeb-service/src/main/java/com/zbkj/service/service/impl/UploadServiceImpl.java of the component Admin Upload. Performing a manipulation of the argument model results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284CWE-434

Affected software

No affected versions have been published.

Timeline

Published
May 3, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-767306.5An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjaCVE-2026-767316.5An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to CVE-2026-767326.4A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation CVE-2026-767334.9A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with adCVE-2026-767344.8A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to cCVE-2026-767354.1A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitaCVE-2026-767363.3A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow CVE-2026-767373.0An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation couCVE-2026-767382.7A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with admiCVE-2026-767394.3A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploiCVE-2026-76748.8A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. This issue affects the function start_single_service of the cCVE-2026-767407.2A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be expl
CVE-2026-7673: Medium severity, CVSS 4.7 | Vulnix