CVE-2026-80235
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Risk Assessment
An attacker could gain full control of the server, compromising confidentiality, integrity, and availability.
Recommendation
Update EFence to the latest version. Restrict access to file upload functionality and implement file validation mechanisms.
Other vulnerabilities in EFence
See all- CVE-2026-89180High
EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
- CVE-2026-80237High
EFence by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, enabling arbitrary code execution on the server.
- CVE-2026-80236High
Efence by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents.
Original NVD description (English source)
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS