{
  "id": "CVE-2026-110469",
  "url": "https://spydr.io/cve/CVE-2026-110469",
  "published": "2026-11-09T13:17:03.910Z",
  "modified": "2026-11-09T13:17:03.910Z",
  "score": 10,
  "severity": "critical",
  "cvss_version": "4.0",
  "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "score_source": "cert.pl",
  "epss": null,
  "epss_percentile": null,
  "exploited": false,
  "kev": null,
  "ssvc_exploitation": null,
  "vendors": [
    "Fundacja Widzialni"
  ],
  "products": [
    "Fundacja Widzialni WidzialniCMS"
  ],
  "cwes": [
    "CWE-434"
  ],
  "description": "WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.",
  "status": "Received",
  "score_type": "Secondary",
  "scores": {
    "cvss_v40": 10,
    "cvss_v31": null,
    "cvss_v30": null
  },
  "references": [
    {
      "url": "https://cert.pl/posts/2026/11/CVE-2026-110468",
      "tags": []
    },
    {
      "url": "https://widzialni.org/funkcjonalnosci-widzialni-cms,sd,mg,0,175",
      "tags": []
    }
  ],
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110469",
  "covered_in": [],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}