CVE-2026-22781: fallo crítico en maximmasiutin TinyWeb
TinyWeb CGI Command Injection
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 10epss 2.4%
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Productos afectados
maximmasiutin · TinyWebCVEs relacionadas — maximmasiutin TinyWeb
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-27613CRITICALCGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)EPSS 0.9%CVE-2026-28497CRITICALTinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)EPSS 0.5%CVE-2026-27633HIGHTinyWeb has Unbounded Content-Length Memory Exhaustion (DoS)EPSS 0.5%CVE-2026-27630HIGHTinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)EPSS 0.5%CVE-2026-29046CRITICALTinyWeb: HTTP Header Control Character Injection into CGI EnvironmentEPSS 0.4%