CVE-2026-82789
An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS). If exploited, arbitrary code may be executed by an attacker who can log in to the product.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.30%
- CWE
- CWE-95
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- Contec CONPROSYS HMI System(CHS)
Weakness type
Related vulnerabilities
- CVE-2025-24893 — Remote code execution as guest via SolrSearchMacros request in xwiki
- CVE-2024-36401 — Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
- CVE-2023-7101 — Arbitrary Code Execution (ACE) Vulnerability
- CVE-2024-31982 — XWiki Platform: Remote code execution as guest via DatabaseSearch
- CVE-2024-21650 — XWiki Remote Code Execution vulnerability via user registration
- CVE-2024-7954 — SPIP porte_plume Plugin Arbitrary PHP Execution
- CVE-2023-37462 — Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui
- CVE-2026-33017 — Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint