Zurück zur CVE-Übersicht
CVE-2026-107337
HIGH(7.1)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Risk Signal Score18/100 — NIEDRIG
- CVSS 7.1 — Hoch
Erwähnungen (letzte 60 Tage)
Artikel
EPSS-Score
0.1%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
7.1
Technische Schwere
Beschreibung
The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.