EUVD-2026-59848
GHSA-fxrg-9hfp-v3x8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint (AV:N) requires low-privilege auth (PR:L); GroovyShell.evaluate enables arbitrary JVM and OS code execution, warranting high vulnerable-system impact and low subsequent-system impact via OS access.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that "it’s being processed".
AnalysisAI
Remote code injection in DefaultFuction Notice-System-Managent 2.0 allows low-privilege authenticated attackers to execute arbitrary Groovy code by sending crafted input to the /execute endpoint, which passes unsanitized values directly to GroovyShell.evaluate in NoticeController. A public proof-of-concept exploit is available via the project's GitHub issue tracker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid application account with at minimum low-privilege access, as confirmed by CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P) suggests moderate severity, but the low impact metrics almost certainly understate the actual consequence of code injection via GroovyShell.evaluate, which can trivially escalate to full OS-level command execution - a discrepancy that security teams should explicitly flag when triaging this finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the project maintainer has acknowledged the report with 'it's being processed' but no fix version is available from any reference. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today