Vulnerability · Published Aug 16, 2026 · Assigned by VulDB
CVE-2026-19932DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection
Medium 6.3
In plain English
A medium-severity code injection in Notice-System-Managent from DefaultFuction. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that "it’s being processed".
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| DefaultFuction | Notice-System-Managent | 2.0 |
Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-390703 | DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection vdb-entry, technical-description
- VDB-390703 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-19932 | CVE Analysis and Report third-party-advisory
- Submit #872648 | DefaultFuction Notice System Managent V2.0 Code Injection third-party-advisory
- https://github.com/DefaultFuction/Notice-System-Managent/issues/1 exploit, issue-tracking
- https://github.com/DefaultFuction/Notice-System-Managent/ product