Search
Find a vulnerability
Search criteria
4 vulnerabilities found for WidzialniCMS by Fundacja Widzialni
CVE-2026-112205 (GCVE-0-2026-112205)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:49 – Updated: 2026-11-09 17:34
VLAI
EPSS
VEX
Title
Bruteforce Protection Bypass in WidzialniCMS
Summary
WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.
This issue has been fixed in version 2.5.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:50 UTC
CWE
- CWE-307 - Improper restriction of excessive authentication attempts
Assigner
CERT-PL
CNA
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/11/CVE-2026-110468 | third-party-advisory |
| https://widzialni.org/funkcjonalnosci-widzialni-c… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fundacja Widzialni | WidzialniCMS |
Affected:
0 , < 2.5
(custom)
cpe:2.3:a:fundacja_widzialni:widzialnicms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112205",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:50:04.410041Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:34:42.224Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WidzialniCMS",
"vendor": "Fundacja Widzialni",
"versions": [
{
"lessThan": "2.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fundacja_widzialni:widzialnicms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.5",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Miko\u0142aj Matuszewski (CERT.PL)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cspan\u003eWidzialniCMS is vulnerable to\u0026nbsp;\u003c/span\u003eBruteforce Protection Bypass\u003cspan\u003e\u0026nbsp;in the login\u0026nbsp;\u003c/span\u003efunctionality\u003cspan\u003e. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies\u003c/span\u003e\u003cspan\u003e, allowing an unauthenticated attacker to perform an unlimited number of login attempts.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003eThis issue has been fixed in version 2.5.\u003c/div\u003e"
}
],
"value": "WidzialniCMS is vulnerable to\u00a0Bruteforce Protection Bypass\u00a0in the login\u00a0functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts.\n\n\n\n\nThis issue has been fixed in version 2.5."
}
],
"impacts": [
{
"capecId": "CAPEC-49",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-49 Password Brute Forcing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper restriction of excessive authentication attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:49:45.808Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/11/CVE-2026-110468"
},
{
"tags": [
"product"
],
"url": "https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Bruteforce Protection Bypass in WidzialniCMS",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-112205",
"datePublished": "2026-11-09T12:49:45.808Z",
"dateReserved": "2026-10-19T10:05:51.861Z",
"dateUpdated": "2026-11-09T17:34:42.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112204 (GCVE-0-2026-112204)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:48 – Updated: 2026-11-09 17:34
VLAI
EPSS
VEX
Title
Reflected XSS in WidzialniCMS
Summary
WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.
This issue has been fixed in version 2.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:49 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
CERT-PL
CNA
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/11/CVE-2026-110468 | third-party-advisory |
| https://widzialni.org/funkcjonalnosci-widzialni-c… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fundacja Widzialni | WidzialniCMS |
Affected:
0 , < 2.5
(custom)
cpe:2.3:a:fundacja_widzialni:widzialnicms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112204",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:49:29.521039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:34:42.359Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"/index.php"
],
"product": "WidzialniCMS",
"vendor": "Fundacja Widzialni",
"versions": [
{
"lessThan": "2.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fundacja_widzialni:widzialnicms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.5",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Miko\u0142aj Matuszewski (CERT.PL)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim\u0027s browser, allowing e.g session cookie theft.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue has been fixed in version 2.5.\u003c/div\u003e"
}
],
"value": "WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim\u0027s browser, allowing e.g session cookie theft.\n\n\nThis issue has been fixed in version 2.5."
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:48:56.104Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/11/CVE-2026-110468"
},
{
"tags": [
"product"
],
"url": "https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Reflected XSS in WidzialniCMS",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-112204",
"datePublished": "2026-11-09T12:48:56.104Z",
"dateReserved": "2026-10-19T10:05:51.861Z",
"dateUpdated": "2026-11-09T17:34:42.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110469 (GCVE-0-2026-110469)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:47 – Updated: 2026-11-09 17:34
VLAI
EPSS
VEX
Title
Remote Code Execution via Unrestricted File Upload in WidzialniCMS
Summary
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.
This issue has been fixed in version 2.5.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:50 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
CERT-PL
CNA
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/11/CVE-2026-110468 | third-party-advisory |
| https://widzialni.org/funkcjonalnosci-widzialni-c… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fundacja Widzialni | WidzialniCMS |
Affected:
0 , < 2.5
(custom)
cpe:2.3:a:fundacja_widzialni:widzialnicms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110469",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:50:35.392549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:34:42.496Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"/panel/upload.php"
],
"product": "WidzialniCMS",
"vendor": "Fundacja Widzialni",
"versions": [
{
"lessThan": "2.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fundacja_widzialni:widzialnicms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.5",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kamil Szczurowski"
},
{
"lang": "en",
"type": "finder",
"value": "Robert Kruczek"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php\u0026nbsp;endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue has been fixed in version 2.5.\u003c/div\u003e"
}
],
"value": "WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php\u00a0endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\n\n\nThis issue has been fixed in version 2.5."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:47:25.746Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/11/CVE-2026-110468"
},
{
"tags": [
"product"
],
"url": "https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Remote Code Execution via Unrestricted File Upload in WidzialniCMS",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-110469",
"datePublished": "2026-11-09T12:47:25.746Z",
"dateReserved": "2026-10-14T07:27:21.675Z",
"dateUpdated": "2026-11-09T17:34:42.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110468 (GCVE-0-2026-110468)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:46 – Updated: 2026-11-09 17:34
VLAI
EPSS
VEX
Title
Remote Code Execution via Unrestricted File Upload in WidzialniCMS
Summary
WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.
This issue has been fixed in version 2.5.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:51 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
CERT-PL
CNA
References
2 references
| URL | Tags |
|---|---|
| https://cert.pl/posts/2026/11/CVE-2026-110468 | third-party-advisory |
| https://widzialni.org/funkcjonalnosci-widzialni-c… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fundacja Widzialni | WidzialniCMS |
Affected:
0 , < 2.5
(custom)
cpe:2.3:a:fundacja_widzialni:widzialnicms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110468",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:51:32.057069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:34:42.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"/panel/controllers/save_photo.php"
],
"product": "WidzialniCMS",
"vendor": "Fundacja Widzialni",
"versions": [
{
"lessThan": "2.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fundacja_widzialni:widzialnicms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.5",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kamil Szczurowski"
},
{
"lang": "en",
"type": "finder",
"value": "Robert Kruczek"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php\u0026nbsp;endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis issue has been fixed in version 2.5.\u003c/div\u003e"
}
],
"value": "WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php\u00a0endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution.\n\n\nThis issue has been fixed in version 2.5."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:46:33.217Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2026/11/CVE-2026-110468"
},
{
"tags": [
"product"
],
"url": "https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Remote Code Execution via Unrestricted File Upload in WidzialniCMS",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2026-110468",
"datePublished": "2026-11-09T12:46:33.217Z",
"dateReserved": "2026-10-14T07:27:21.675Z",
"dateUpdated": "2026-11-09T17:34:42.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}