CVE-2026-22781: falha crítica em maximmasiutin TinyWeb
TinyWeb CGI Command Injection
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 2.4%
TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
maximmasiutin · TinyWebCVEs relacionadas — maximmasiutin TinyWeb
No mesmo produto, das mais perigosas para as menos.
CVE-2026-27613CRITICALCGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)EPSS 0.9%CVE-2026-28497CRITICALTinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)EPSS 0.5%CVE-2026-27633HIGHTinyWeb has Unbounded Content-Length Memory Exhaustion (DoS)EPSS 0.5%CVE-2026-27630HIGHTinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)EPSS 0.5%CVE-2026-29046CRITICALTinyWeb: HTTP Header Control Character Injection into CGI EnvironmentEPSS 0.4%