CVE-2026-113388

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."

• CWE-74
• CWE-94

• https://gist.github.com/qianqiusujiu/c0452f09e91de23f002a384038325104
• https://github.com/opensource-socialnetwork/opensource-socialnetwork/
• https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/40945057cb451f0f35153110bc7e889c094400e1
• https://vuldb.com/cve/CVE-2026-113388
• https://vuldb.com/submit/1009749
• https://vuldb.com/vuln/422662
• https://vuldb.com/vuln/422662/cti

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113381A weakness has been identified in Osclass up to 8.3.1. Affec…7.3
• CVE-2026-113382A security vulnerability has been detected in arizu-id fast-…6.3
• CVE-2026-113383A vulnerability was detected in Optimal IdM OptimalCloud 5.0…4.3
• CVE-2026-113384A flaw has been found in Optimal IdM OptimalCloud 5.0. This …4.3
• CVE-2026-113385A vulnerability has been found in LeeDrOiD Labs Shortcutter …5.3
• CVE-2026-113386Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are a…7.1
• CVE-2026-113389A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Re…9.9
• CVE-2026-11339A vulnerability was detected in D-Link DWR-M920 up to 1.1.50…8.8
• CVE-2026-113390A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision …9.9
• CVE-2026-113391A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 …9.9
• CVE-2026-113392A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revis…7.4
• CVE-2026-113393A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 …6.3