by Kastro
Paper/Archive/CVE-2026-10071

CVE-2026-10071

Interinfo DreamMaker — Interinfo｜DreamMaker - Arbitrary File Upload

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 43.4.434 × 208.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

DreamMaker developed by Interinfo has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Affected

ProductAffectedFixed inSource
DreamMaker≤ Java Composer 2.2–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-10943-8fb00-1.htmlwriteuptwcert.org.tw/en/cp-139-10946-1127f-2.html