CVE-2026-113404

{
  "etk_id": "ETK-2026-2126",
  "cve_id": "CVE-2026-113404",
  "display_id": "CVE-2026-113404",
  "ghsa_id": "GHSA-jppw-qwg2-2hgc",
  "euvd_id": "EUVD-2026-104808",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Insecure deserialization in Uniong WebITR",
  "summary": "Uniong WebITR is affected by an insecure deserialization flaw involving an embedded cryptographic key. An authenticated remote attacker able to use that key may cause code to run on the server by submitting crafted serialized input.",
  "mitigation": "Restrict access to WebITR to trusted authenticated users and disable or isolate interfaces that accept serialized data where possible. Replace the embedded key and remove reliance on unsafe deserialization; no fixed WebITR version is recorded.",
  "vendor": "Uniong",
  "product": "WebITR",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2_1_0_34"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "WebITR",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0035,
  "epss_percentile": 0.2733,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.233271316666666,
  "t0_at": "2026-10-20T06:24:08.653000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-20T06:24:08.653000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T06:24:08.653000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-113404"
    }
  }
}