CVE-2026-16210 MEDIUM

CVE-2026-16210: newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication

Vendor Newpanjing
Product simpleui
Weakness CWE-306 · Missing auth
Published July 19, 2026
Last update July 19, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Key dates

02Disclosure timeline

July 19, 2026 CVE published