VulnSocial

CVE-2026-90843General

LOWCVSS 5.5 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of the file functions_nmap.py of the component New Nmap Scan Handler. Such manipulation of the argument target/params leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 3d52f65803a2716bff14d938352c6fef45b0cfb6. A patch should be applied to remediate this issue. This issue got fixed with a silent patch.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-77CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • General: 3 classified signals
  • Peaked 2d ago at 2 mentions (2026-09-14); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-09-14: 2Mentions · 2026-09-15: 1Mentions · 2026-09-23: 1PoC Mentioned / Linked · 2026-09-14: 1Exploit Tool / Code · 2026-09-14: 1Technical Details · 2026-09-14: 109-1409-1509-23
Signal classification2 categories
General
375.0%
PoC
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-142
General1PoC1
2026-09-151
General1
2026-09-231
General1
Full discourse4 posts
  • سلطان@CalledSTRIKER
    General

    I'm actively seeking a role as a Penetration Tester/VAPT in Saudi Arabia. I’m OSCP+, eWPTX, CAPenX certified, with experience in web application, API, and enterprise AD exploitation, independent vulnerability research CVE-2026-90843. I've attached my CV below with more details https://t.co/hI3SsGeyqz

    Post summary

    The post is a job-seeking message that briefly mentions a CVE under vulnerability research but provides no concrete indicators of PoC, exploit availability, active exploitation, patching, or technical vulnerability details.

    381107638.4K
    3.1K followersView on X
  • سلطان@CalledSTRIKER
    PoC

    الحمدلله الذي بنعمته تتم الصالحات Excited to share that I have been assigned CVE-2026-90843 (CVSS 8.3) for uncovering a critical vulnerability in WebMap. Technical writeup and PoC are available here: https://calledstriker.gitbook.io/blog/security-research/webmap https://t.co/ne7iTPnWKM

    Post summary

    The text announces a newly assigned CVE for a critical WebMap vulnerability and points readers to a technical writeup and PoC. It does not mention active exploitation, patches, or debunking.

    34156164.3K
    3.2K followersView on X
  • سلطان@CalledSTRIKER
    General

    يالله صباح الخير للي يسأل للتو نزلت الثغرة على MITRE 😄 https://www.cve.org/CVERecord?id=CVE-2026-90843 https://t.co/Ua2rvmguMZ

    Post summary

    The tweet merely announces that CVE-2026-90843 has been posted on MITRE with a link, without mentioning a PoC, exploit, active exploitation, patch, or technical details.

    0001431.9K
    3.2K followersView on X
  • سلطان@CalledSTRIKER
    General

    Advisory links: https://vuldb.com/vuln/403395 https://nvd.nist.gov/vuln/detail/cve-2026-90843 https://www.cve.org/CVERecord?id=CVE-2026-90843

    Post summary

    The text merely lists advisory links for CVE‑2026‑90843 without any additional context, PoC, exploit, patch, or exploitation information.

    00000466
    3.1K followersView on X

Explore more

Back to dashboard