CVE-2026-5031

The record

A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_route=settings/users-view/ of the component Endpoint. The manipulation of the argument ID results in improper control of resource identifiers. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages

Related vulnerabilities

• CVE-2026-114726 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header… CWE-99
• CVE-2026-114725 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header… CWE-99
• CVE-2026-114716 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header… CWE-99
• CVE-2026-114717 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header… CWE-99
• CVE-2026-106583 In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username… CWE-99
• CVE-2026-62910 Improper control of resource identifiers ('resource injection') in Microsoft Exchange… CWE-99
• CVE-2026-15186 A vulnerability was identified in macrozheng mall up to 1.0.3. CWE-99
• CVE-2026-12207 A security flaw has been discovered in medkey-org medkey up to… CWE-99