VulnSocial

CVE-2026-112862

LOWCVSS 9.8 ยท CRITICAL

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This issue affects Participants Database: from n/a through 2.7.8.5.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post
  • NewNormal Security@NewScanTeam

    NewNormal Security turns CVEs since the previous batch into new detections, every day. ๐——๐—ฎ๐—ถ๐—น๐˜† ๐—–๐—ฉ๐—˜ ๐—ฅ๐—ฒ๐—ฝ๐—ผ๐—ฟ๐˜ โ€” 23 Oct 2026 ๐—”๐—ฑ๐—ฑ๐—ฒ๐—ฑ to NewScan ๐˜๐—ผ๐—ฑ๐—ฎ๐˜†: ๐Ÿ“ฆ Unpatched plugin version, pulled from the plugin directory โ€” a crafted object runs code on the site, or the database reads back a character at a time (xnau Participants Database CVE-2026-112862, CVE-2026-112860) ๐Ÿ”“ Front-end form that updates posts with no capability check โ€” an anonymous visitor overwrites the posts holding the site's own field definitions (ACF Extended CVE-2026-94267) ๐Ÿ”Ž Database access gateway fingerprint โ€” the console fronting every database behind it now gets named in the inventory (Bytebase) Test your stack with NewScan โ€” free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #ObjectInjection #CSO #REDTEAM

    0000023
    6 followersView on X

Explore more

Back to dashboard