HIGH 8.8 NVD
CVE-2026-27556
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator co
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.
References
- https://www.certvde.com/en/advisories/VDE-2026-014/
- https://www.certvde.com/en/advisories/VDE-2026-027/
- https://www.certvde.com/en/advisories/VDE-2026-028/
This high severity vulnerability with a CVSS score of 8.8 was published on 2026-09-16 via NVD.
vulnfeed aggregates 14123 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.