CVE-2026-89308

An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution.

CVSS

No CVSS.

References

Link	Resource
https://www.acn.gov.it/portale/w/trexom-aggiornamenti-di-sicurezza
https://www.trexom.net/sviluppo-di-app/

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-15 12:17

Updated : 2026-09-15 13:16

NVD link : CVE-2026-89308

Mitre link : CVE-2026-89308

CVE.ORG link : CVE-2026-89308

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-89308", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-89308", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-15T12:30:47.734324Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "affectedData": [{"vendor": "TREXOM", "product": "TrxTimeATTENDANCE", "versions": [{"status": "affected", "version": "1.0.5", "lessThan": "1.9.6", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-15T12:17:53.603", "references": [{"url": "https://www.acn.gov.it/portale/w/trexom-aggiornamenti-di-sicurezza", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}, {"url": "https://www.trexom.net/sviluppo-di-app/", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated OS command injection vulnerability exists in the\u00a0ping.php\u00a0endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution."}], "lastModified": "2026-09-15T13:16:45.543", "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}

CVE-2026-89308

JSON object

Attach tags to CVE-2026-89308

Attach tags to `CVE-2026-89308`