EUVD-2026-63224
GHSA-cv6m-pghp-xm7f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires low-privilege authentication (PR:L); only user enumeration data is disclosed (C:L) with no integrity or availability impact and no scope change.
Primary rating from Vendor (CERTVDE).
CVSS VectorVendor: CERTVDE
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.
AnalysisAI
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete conditions: first, the attacker must possess at least one valid low-privilege credential for the FDS 102 system (confirmed by CVSS PR:L); second, the FDS 102 web interface must be reachable from the attacker's network position (confirmed by CVSS AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) reflects an accurate signal: VC:L captures partial confidentiality loss (user list and privilege mapping, not credentials or operational data), and PR:L correctly gates exploitation on possession of at least one valid credential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding any valid low-privilege account - such as a read-only monitoring credential - authenticates to the FDS 102 web interface and issues an HTTP request to /api/user/fetch-all.php, receiving a response that lists all configured usernames and their associated privilege levels. With this map of administrative accounts in hand, the attacker can target high-value credentials for brute-force, phishing, or session hijacking to escalate privileges within the railway diagnostic system. … |
| Remediation | Consult CERTVDE advisory VDE-2026-078 (https://www.certvde.com/en/advisories/VDE-2026-078/) for vendor-supplied patch information; an exact fixed version was not independently confirmed from the available data, so the advisory is the authoritative source for upgrade guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same weakness CWE-425 – Direct Request ('Forced Browsing')
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today