CVE-2026-49827

CVE

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

August 13, 2026

Last Seen

August 14, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical RCE Vulnerability in WebErpMesv2 Affects Self-Registered Users72.6

CVE-2026-49827, published on August 13, 2026, reveals a critical vulnerability in WebErpMesv2 versions 1.19 and prior. This flaw allows unauthenticated remote code execution through arbitrary PHP file uploads via the HR Expense scan_file parameter. The vulnerability is exacerbated by open user regis...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical RCE Vulnerability in WebErpMesv2 Affects Self-Registered Users

Aug 14·1 sources

Related Articles (2)

CVE-2026-49827 - WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434) Latest High/Critical Vulnerabilitiy Feed / 10h CVE ID : CVE-2026-49827 Published : Aug. 13, 2026, 1:19 p.m. 16 minutes ago Description : WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execu

cvefeed.io·Aug 14

CVE-2026-49827 - Exploits & Severity

Related Entities

Zero-day Exploit CWE-434 - Unrestricted Upload Of File With Dangerous Type CWE-20 - Improper Input Validation CWE-306 - Missing Authentication For Critical Function T1190 - Exploit Public-Facing Application WebErpMesv2