Log in Start free

Vulnerability · Published Jun 2, 2026 · Assigned by VulDB

CVE-2026-10550elunez eladmin Application Deployment App.java command injection

Medium 6.3

In plain English

A medium-severity command injection in eladmin from elunez. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)1.2%top 32.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in elunez eladmin up to 2.7. This vulnerability affects unknown code of the file App.java of the component Application Deployment Module. This manipulation of the argument uploadPath causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

VendorProductVersions
elunez eladmin 2.02.12.22.32.42.52.62.7

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References