CVE-2026-85134
8.8 HIGHPublished 2026-09-28 · Updated 2026-09-28
AI risk analysis
- Summary
- Allows an attacker to upload a web shell, gaining remote code execution capabilities on the web server.
- Exploitability
- Exploitation is relatively straightforward given the ability to upload a web shell, requiring only access to the affected version of the software.
- Blast radius
- If exploited, the impact could be severe, as it allows full control over the web server hosting the vulnerable system.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to eBA Plus Document and Workflow Management System 10.0.11 or later.
rcewebupload
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web Shell to a Web Server. This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-12264
- CRITICALCVE-2026-14175
- CRITICALCVE-2026-18143
- HIGHCVE-2026-54416PoC
- HIGHCVE-2026-6147
- CRITICALCVE-2026-70356PoC
- CRITICALCVE-2026-82187
- CRITICALCVE-2026-82901
Related by shared AI tags and CWE weakness class. Browse the full archive.