CVE-2026-8739: fallo de gravedad media en Sanluan PublicCMS
Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.9epss 0.3%
A vulnerability was detected in Sanluan PublicCMS 5.202506.d. The affected element is the function getSignKey of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java. The manipulation of the argument privatefile_key results in use of hard-coded cryptographic key
. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
Sanluan · PublicCMSPoCs públicas encontradas — 1
cve_referencevulnplus-note.wetolink.com/share/PCVUlOncmwTCno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Sanluan PublicCMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-3289MEDIUMSanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversalEPSS 0.8%CVE-2026-1111MEDIUMSanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversalEPSS 0.7%CVE-2026-1112MEDIUMSanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorizationEPSS 0.4%CVE-2026-8737MEDIUMSanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authenticationEPSS 0.4%CVE-2024-11070MEDIUMSanluan PublicCMS Tag Type save cross site scriptingEPSS 0.4%CVE-2025-7953MEDIUMSanluan PublicCMS viewer.html redirectEPSS 0.4%