Is there a public PoC exploit available for EUVD-2026-23864?

Yes, a public proof-of-concept exploit is available for EUVD-2026-23864. Prioritise patching immediately. EPSS: 0.0%.

Cms EUVD-2026-23864

Q: What is the CVSS score of EUVD-2026-23864?

EUVD-2026-23864 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-6649 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-20 VulDB

GHSA-x2wv-w39c-7c55

SSRF Cms

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 20, 2026 - 14:33 vuln.today

CVSS changed

Apr 20, 2026 - 14:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 20, 2026 - 14:15 euvd

EUVD-2026-23864

Analysis Generated

Apr 20, 2026 - 14:15 vuln.today

CVE Published

Apr 20, 2026 - 13:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown functionality of the file /index/image/headers. Executing a manipulation of the argument starts can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in Qibo CMS 1.0 allows authenticated remote attackers to manipulate the 'starts' parameter in /index/image/headers endpoint, triggering arbitrary internal requests from the server. Publicly available exploit code exists. The vendor did not respond to early disclosure notification, leaving no patched version available.

Technical ContextAI

The vulnerability exploits CWE-918 (Server-Side Request Forgery), a class of flaws where untrusted user input is used to construct requests originating from the server itself. In Qibo CMS 1.0 (CPE: cpe:2.3:a:qibo:cms:*:*:*:*:*:*:*:*), the /index/image/headers endpoint processes the 'starts' parameter without proper validation or URL scheme filtering. An attacker with valid authentication credentials can inject malicious values into this parameter, causing the server to make HTTP requests to internal or external resources under the server's identity and network context. This enables reconnaissance of internal infrastructure, access to services restricted by firewall rules, or interaction with internal APIs.

RemediationAI

Upgrade to a newer version of Qibo CMS if available from an alternative vendor source or community fork, as the original vendor has not released patches. If upgrading is not immediately feasible, implement strict network egress controls: configure firewall rules to block outbound connections from the Qibo CMS application server to internal IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and restrict outbound HTTP/HTTPS traffic to a whitelist of required external services only. Additionally, enforce strong authentication and role-based access control to minimize the number of users with credentials that could be compromised and used to exploit this endpoint. Input validation patches are not available from the vendor, so compensating controls must rely on network segmentation. Monitor outbound HTTP connections from the Qibo CMS server for anomalous destinations or patterns indicative of SSRF exploitation. Reference: VulDB disclosure at https://vuldb.com/vuln/358283.