Loading story…
CERT Polska disclosed two vulnerabilities in Simple SA's Wirtualna Uczelnia software, including CVE-2026-34906, a server-side template injection flaw that can let an unauthenticated attacker achieve remote code execution through the redirectToUrl endpoint and its redirectUrlParameter parameter. The issue affects versions up to and including wu#2016.437.295#0#20260327_105545, and public vulnerability records describe network-based exploitation with low attack complexity, no required privileges, and no user interaction. The flaw is classified as CWE-1336 and could allow arbitrary template expressions to execute on the server, including commands that establish a reverse shell.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
CISA added Oracle WebLogic flaw CVE-2024-21182 to its Known Exploited Vulnerabilities catalog after it was found to be actively exploited in attacks. Federal agencies were ordered to patch by June 4 under Binding Operational Directive 22-01, and private-sector defenders were urged to remediate quickly.
CVE-2026-34906 was recorded by cvd@cert.pl on June 2, 2026. The entry describes an unauthenticated SSTI in the redirectToUrl endpoint's redirectUrlParameter that can lead to remote code execution, including reverse shell access.
CERT Polska disclosed CVE-2026-34906 and CVE-2026-34907 affecting Simple SA's Wirtualna Uczelnia on 2026-06-02. The issues are an unauthenticated SSTI leading to remote code execution and a reflected XSS flaw, affecting versions through wu#2016.437.295#0#20260327_105545; Dawid Bakaj of VIPentest was credited with reporting them.
Oracle patched CVE-2024-21182 in July 2024. The high-severity Oracle WebLogic Server vulnerability affects versions 12.2.1.4.0 and 14.1.1.0.0 and can be exploited remotely without authentication over T3 or IIOP.
IBM disclosed CVE-2026-8644, an identity spoofing vulnerability in WebSphere Application Server, and rated it CVSS 9.1. IBM said affected users should apply interim fix APAR PH71422 or upgrade to fixed releases 9.0.5.29 or 8.5.5.30 and later, with no workarounds available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcebleepingcomputer.com
Open sourceibm.com
Open sourcecert.pl
Open sourcecert.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed 13 vulnerabilities in **ATutor 2.2.4** tracked as `CVE-2026-64960` through `CVE-2026-64972`, warning that the unsupported learning management platform is affected by multiple high-impact weaknesses with **no available fixes**. The issues include unrestricted file upload, authentication bypass, CSRF, path traversal, predictable account activation tokens, missing authorization, SSRF, IDOR, and stored and reflected XSS. CERT Polska said the flaws can be chained to achieve **remote code execution**, administrator account compromise, arbitrary file access, unauthorized content import, and profile manipulation. One of the most serious issues involves **unrestricted upload of dangerous file types**, a weakness aligned with **`CWE-434`**, in which an application accepts executable or otherwise unsafe files that are then processed by the server. MITRE notes that such flaws can lead to arbitrary code execution and broader confidentiality, integrity, and availability impacts, especially when uploaded files are placed in web-accessible locations or extracted without proper validation. CERT Polska credited Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team with the responsible disclosure and said only version 2.2.4 was confirmed vulnerable, although other versions may also be affected.
Aug 20, 2026
CERT Polska disclosed three vulnerabilities in **JCD Windu CMS** affecting confirmed version **4.1**, warning that other versions may also be impacted. The issues include **CVE-2026-57309**, a blind SQL injection mapped to **`CWE-89`** that can be exploited remotely without authentication by injecting SQL syntax into a URL path carried in an HTTP header, and **CVE-2026-57310**, a password storage weakness mapped to **`CWE-916`** caused by the use of **MD5** and **SHA1** with a static salt. The advisory also details **CVE-2026-57311**, an unrestricted file upload flaw that allows an authenticated attacker to upload arbitrary files, including **PHP**, resulting in remote code execution. CERT Polska said it coordinated disclosure of the vulnerabilities and credited **Jakub Lipiński, Marek Tołczyk, and Kamil Królikowski** with the responsible report, underscoring the risk of database compromise, credential exposure, and server takeover in affected Windu CMS deployments.
Jul 20, 2026
CERT Polska disclosed two vulnerabilities in Asseco **proCertum SmartSign** that can be triggered through crafted certificates and signature files. **CVE-2026-57916** is a `CWE-73` weakness caused by opening a Certificate Practice Statement URI without validating its schema, allowing an attacker to prepare a certificate that launches a local file or opens a remote URL when a victim opens a signed document. The issue reflects the broader risk of externally controlled file names or paths, which can lead to unauthorized file access, modification, or code execution. CERT Polska also reported **CVE-2026-57917**, an `XXE` flaw (`CWE-611`) in SmartSign's handling of XML signatures. A crafted signature file can force the application to resolve external entities, enabling **SSRF** and, depending on parser settings, possible local file disclosure; the bug may be triggered even when a user only previews a file in the selection window before opening it. Both vulnerabilities affect versions prior to **9.4.3.90** and were fixed in **9.4.3.90**; the issues were responsibly reported by **Mariusz Maik**.
Jul 27, 2026