HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-69100 — LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains...

·Source: NIST NVD

Updated:

Executive Summary

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend

Analysis

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend server. CVSS Score: 8.8. Published: 2026-08-04T16:16:28.340.

Indicators of Compromise (1)

CVE (1)
CVE-2026-69100
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 4, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-70553 — MaxSite CMS contains a remote code execution vulnerability that allows unauthent...

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/databa

CVE-2026-70553
NIST NVD
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-70552 — MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in...

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any *-ajax.php file in the codebase. Attackers can exploit this dispatcher bypass to reach privileged plugin endpoints without credentials

CVE-2026-70552
NIST NVD
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-18810 — A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an ...

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure.

CVE-2026-18810
NIST NVD