Simpleui
Monthly
Missing authentication on the AjaxAdmin AJAX endpoint in newpanjing simpleui 2026.01.13 allows unauthenticated remote attackers to invoke privileged Django admin actions via the `self.get_action` function in `simpleui/admin.py`. A public proof-of-concept exploit exists on GitHub (issue #537), and the vendor has not responded to the disclosure, leaving the vulnerability unpatched. No active exploitation confirmed by CISA KEV, but the combination of PR:N network exposure and available POC makes any internet-facing deployment immediately actionable by low-skill attackers.
Missing authentication on the AjaxAdmin AJAX endpoint in newpanjing simpleui 2026.01.13 allows unauthenticated remote attackers to invoke privileged Django admin actions via the `self.get_action` function in `simpleui/admin.py`. A public proof-of-concept exploit exists on GitHub (issue #537), and the vendor has not responded to the disclosure, leaving the vulnerability unpatched. No active exploitation confirmed by CISA KEV, but the combination of PR:N network exposure and available POC makes any internet-facing deployment immediately actionable by low-skill attackers.