Pig
Monthly
Unauthenticated credential takeover in pig-mesh Pig before 4.1.0 allows any remote attacker who can reach the /register/password endpoint to overwrite the password of an arbitrary account, including the built-in 'admin' account, and thereby obtain full administrative control of the platform. The flaw is an authentication bypass: the endpoint's password-reset logic calls checkPassword() but discards the boolean result, so the submitted 'current password' is never actually validated. Publicly available exploit code exists (a proof-of-concept write-up and the upstream issue are linked), and the vendor has released version 4.1.0 as the fix; there is no indication of confirmed exploitation in CISA KEV at the time of analysis, but the combination of unauthenticated remote exploitation, high impact (CVSS 4.0 base 9.3; independently assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and public exploit code makes rapid patching warranted.
Information disclosure in pig (pig-mesh) through 4.1.1 allows any authenticated user to read arbitrary users' profile data via the GET /admin/user/details/{id} endpoint, which lacks per-object authorization checks (CWE-862). Attackers can enumerate sequential user IDs to harvest usernames, real names, phone numbers, emails, third-party account links, and role assignments; the issue requires a valid low-privilege account (PR:L) and has no write, privilege-escalation, or availability impact. No public exploit identified at time of analysis; no vendor-released patch is identified in the available data.
Remote code injection in pig-mesh Pig's pig-codegen module through version 3.9.2 allows low-privileged authenticated attackers to execute arbitrary code server-side via the GeneratorServiceImpl component, reachable over the network. A publicly available proof-of-concept exploit exists at GitHub (sombra0316/CVE-2026), elevating the urgency for defenders. No vendor patch has been released, and the vendor did not respond to responsible disclosure, leaving affected deployments without an official remediation path.
In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated credential takeover in pig-mesh Pig before 4.1.0 allows any remote attacker who can reach the /register/password endpoint to overwrite the password of an arbitrary account, including the built-in 'admin' account, and thereby obtain full administrative control of the platform. The flaw is an authentication bypass: the endpoint's password-reset logic calls checkPassword() but discards the boolean result, so the submitted 'current password' is never actually validated. Publicly available exploit code exists (a proof-of-concept write-up and the upstream issue are linked), and the vendor has released version 4.1.0 as the fix; there is no indication of confirmed exploitation in CISA KEV at the time of analysis, but the combination of unauthenticated remote exploitation, high impact (CVSS 4.0 base 9.3; independently assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and public exploit code makes rapid patching warranted.
Information disclosure in pig (pig-mesh) through 4.1.1 allows any authenticated user to read arbitrary users' profile data via the GET /admin/user/details/{id} endpoint, which lacks per-object authorization checks (CWE-862). Attackers can enumerate sequential user IDs to harvest usernames, real names, phone numbers, emails, third-party account links, and role assignments; the issue requires a valid low-privilege account (PR:L) and has no write, privilege-escalation, or availability impact. No public exploit identified at time of analysis; no vendor-released patch is identified in the available data.
Remote code injection in pig-mesh Pig's pig-codegen module through version 3.9.2 allows low-privileged authenticated attackers to execute arbitrary code server-side via the GeneratorServiceImpl component, reachable over the network. A publicly available proof-of-concept exploit exists at GitHub (sombra0316/CVE-2026), elevating the urgency for defenders. No vendor patch has been released, and the vendor did not respond to responsible disclosure, leaving affected deployments without an official remediation path.
In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.