CVE-2026-6487 — Qihui Jtbc5 CMS Path Traversal
CVE-2026-6487 — A flaw has been found in Qihui jtbc5 CMS 5.0.3.6. Affected is an unknown function of the file /dev/code/common/diplomat/manage.php of the component Code Endpoint. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The expl
What This Means For You
- If your environment is affected by CWE-22, review your exposure and prioritize patching based on your environment. Monitor vendor advisories for CVE-2026-6487 updates and patches.
Related ATT&CK Techniques
🛡️ Detection Rules
4 rules · 6 SIEM formats4 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Web Application Exploitation Attempt — CVE-2026-6487
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6487 | vulnerability | CVE-2026-6487 |
| CWE-22 | weakness | CWE-22 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 17, 2026 at 16:16 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related Posts
CVE-2026-6492 — Arnobt78 Hotel Booking Management System Information Disclosure
CVE-2026-6492 — A vulnerability was detected in arnobt78 Hotel Booking Management System up to f8922d0e0f6ac1cc761974c7616f44c2bbc04bea. The impacted element is an unknown function of the file...
CVE-2026-6491 — Libvips Buffer Overflow
CVE-2026-6491 — A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of...
SQL Injection Flaw in QueryMine SMS: Remote Exploitation Possible
CVE-2026-6490 — A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. Impacted is an unknown function of the file admin/deletecourse.php of the component...