CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-58466 — AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability...

·Source: NIST NVD

Updated:

Executive Summary

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full c

Analysis

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints. CVSS Score: 9.8. Published: 2026-07-02T20:17:06.593.

Indicators of Compromise (1)

CVE (1)
CVE-2026-58466
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 2, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

WBS and Quai Digital extend fractional dealing partnership

WBS, a leading provider of dealing, custody, and technology solutions to the UK investment industry, today announces a five-year extension of its partnership with Quai Digital.

Finextra
CRITICALVulnerability

NVD CRITICAL: CVE-2026-9725 — The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress...

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path

CVE-2026-9725
NIST NVD
MEDIUMVulnerability

Spyware found on phone of European Parliament member probing it

Stelios Kouloglou, formerly a member of the European Parliament's committee investigation abuses of commercial spyware, was twice infected with Pegasus while serving, researchers said.

The Record