CVE-2026-18720

MediumCVSS 5.3

Published: 04/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

A flaw has been found in kalcaddle kodbox 1.67 Build 02. The vulnerability affects unknown code in the file /index.php?plugin/msgWarning/action of the msgWarning Plugin component. Manipulation can lead to improper authorization, and the attack can be launched remotely. The exploit has been published and may be used.

Risk Assessment

The organization is exposed to unauthorized access to functions or data by a remote attacker, potentially leading to confidentiality or integrity breaches. The published exploit increases the risk of active exploitation.

Recommendation

Immediately check if the vulnerable version kalcaddle kodbox 1.67 Build 02 is in use and apply available updates or workarounds. If no patch is available, consider temporarily disabling the msgWarning Plugin component or restricting access to it.

Other vulnerabilities in kalcaddle kodbox

CVE-2025-10233Medium
kalcaddle kodbox 1.61 has a path traversal vulnerability in the fileGet/fileSave functions in app/controller/explorer/editor.class.php via the path argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS