Skip to content
Sign in Sign up
JA EN FR
SecPulse
A detailed explainer is available in Japanese. Read the Japanese explainer
Critical 9.9

Pugongying X5 Proに認可不備の脆弱性、攻撃コード公開

CVE-2026-120224 First seen on SecPulse

Summary

Oray社のPugongying X5 Proで、権限の低いアカウントから本来許されない操作を実行できる脆弱性が公表されました。攻撃コードが公開され修正版も未確認のため、利用中の組織は管理機能の公開範囲とアカウントを早めに見直してください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

Oray社のPugongying X5 Proで、権限の低いアカウントから本来許されない操作を実行できる脆弱性が公表されました。攻撃コードが公開され修正版も未確認のため、利用中の組織は管理機能の公開範囲とアカウントを早めに見直してください。

Original description The description as published by the source.

A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details