CVE-2026-16210

HIGH

newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication

Title source: cna
STIX 2.1

Description

A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-380026 | newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication
https://vuldb.com/vuln/380026
Signature, Permissions Required signature permissions-required
VDB-380026 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/380026/cti
Third Party Advisory third-party-advisory
CVE-2026-16210 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-16210
Third Party Advisory third-party-advisory
Submit #857929 | newpanjing simpleui 2026.01.13 at commit 85b887022217b4e46c9a34d227dbf38fef1e7a92 CWE-862 Missing Authorization / CWE-863 Incorrect Authorization
https://vuldb.com/submit/857929
Exploit exploit issue-tracking
https://github.com/newpanjing/simpleui/issues/537

Scores

CVSS v3 7.3
EPSS 0.0040
EPSS Percentile 32.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-287 CWE-306
Status published
Products (1)
newpanjing/simpleui 2026.01.13
Published Jul 19, 2026
Tracked Since Jul 19, 2026