cbcvebase.
CVE-2026-1061
published 2026-01-17

CVE-2026-1061: A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file…

PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.36%
27.6th percentile
A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller/FileController.java. The manipulation of the argument filename results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be used.

Affected

30 ranges· showing 25
VendorProductVersion rangeFixed in
xiweichengteamwork_management_system<= 2.28.0—
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——
xiweichengtms——

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.