← voltar
CVE-2026-35056

XenForo Remote Code Execution via Authenticated Admin

CVSS 8.6 HIGHEPSS 0.7%CWE-94
XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
XenForo · XenForo

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
https://www.vulncheck.com/advisories/xenforo-remote-code-execution-via-authenticated-adminhttps://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/