Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-2406 EUVD-2026-47621GHSA-fcfg-fr25-xwpr

IDOR in Universe Software's Online Registration and Workflow Management System

Published Jul 22, 2026 · Updated Aug 5, 2026 · Assigned by TR-CERT

Vendor: Universe Software Computer Marketing Trade and Industry Product: Online Registration and Workflow Management System

Description

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client.

This issue affects Online Registration and Workflow Management System: through 12022026.

Affected products

VendorProductAffectedFixed
Universe Software Computer Marketing Trade and Industry Online Registration and Workflow Management System ≤ 12022026 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • ridpath/Terrminus-CVE-2026-2406 ★ 2 · Jan 30, 2026

    AsyncIO Scanner & Exploitation Framework for CVE-2026-24061 (Telnet NEW_ENVIRON Auth Bypass). Features high-concurrency discovery, passive fingerprinting, and authorized root shell escalation

  • SimoesCTT/CTT-Sovereign-Vortex ★ 0 · Jan 30, 2026

    CTT-Terrminus-Vortex (CVE-2026-2406)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References