CVE-2026-87747

MediumCVSS 4.9/10Last modified Sep 9, 2026

Description

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23

Affected software

Vendor	Product	Versions
Ragic	Enterprise Cloud Database	all

References

Timeline

Published: Sep 9, 2026
Last modified: Sep 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-877488.8Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela CVE-2026-87758.8A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component P CVE-2026-877526.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tour CVE-2026-87755Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB CVE-2026-87756The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran wi CVE-2026-87758The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able CVE-2026-877598.8The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membersh CVE-2026-87768.8A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPS CVE-2026-877608.8The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated vis CVE-2026-877618.0The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authentic CVE-2026-877628.8The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, an CVE-2026-877648.8The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is