CVE-2026-23836
HotCRP vulnerable to remote code execution through formulas
Vexday Risk Score
28Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 10EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
19 ene 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release version 3.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
kohler · hotcrp¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →