CVE-2026-18969

HighCVSS 7.3

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617, affecting an unknown function in the file /dm/dispatch/userinfo/upload. Manipulation of the File argument results in unrestricted upload. The attack can be initiated remotely, and the exploit is public.

Risk Assessment

An attacker can upload malicious files to the server, potentially leading to remote code execution, server takeover, or further system compromise.

Recommendation

Update the platform to the latest patched version. Restrict allowed file types and implement file content validation.

Other vulnerabilities in Rongzhitong Visual Integrated Command and Dispatch Platform

CVE-2026-18970High
A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617, affecting an unknown function in the file /dm/dispatch/user/findAll. Manipulation of the Name argument leads to SQL injection. The attack can be launched remotely, and the exploit has been published.

Original NVD description (English source)

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.