← Back to search

CVE-2026-71252

8.2 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary
The flaw allows unauthorized modification of database entries through admin handlers without proper authentication or authorization checks, posing a significant security risk.
Exploitability
Exploitation is relatively easy given that no authentication is required, and attackers can modify critical data such as printer configurations or toner inventory.
Blast radius
If exploited, the impact could be severe, leading to unauthorized changes in administrative settings or sensitive data manipulation across the system.
Prioritized remediation
Implement strict authentication and authorization checks for all admin handlers to prevent unauthorized database modifications.
auth-bypassrcewebdatabase

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Weaknesses

CWE-862

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.