CVE-2026-19932

EUVD-2026-59848
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that "it’s being processed".
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.98%
Common Weakness Enumeration
References
https://github.com/DefaultFuction/Notice-System-Managent/
https://github.com/DefaultFuction/Notice-System-Managent/issues/1
https://vuldb.com/cve/CVE-2026-19932
https://vuldb.com/submit/872648
https://vuldb.com/vuln/390703
https://vuldb.com/vuln/390703/cti