EIP-2026-118235

This exploit leverages two vulnerabilities in Acunetix WVS 10: a remote command execution flaw via unsafe ActiveX object usage (WScript.shell) and a local privilege escalation due to insecure directory permissions. The PoC delivers a meterpreter shell by exploiting the scheduler service and replacing scripts in an insecure directory.