CVE-2026-22095 CRITICAL

CVE-2026-22095: Command injection in diagnosis web endpoint

Vendor Evbee

Product DC-80

Weakness CWE-77

Published July 13, 2026

Last update July 16, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.

Key dates

02Disclosure timeline

July 13, 2026 CVE published

July 16, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-22095 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html AskarLabs — CWE-77 write-up Command Injection

Related vulnerabilities

04Related CVE

CVE-2024-37091 WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability CVE-2024-34792 WordPress Dextaz Ping plugin <= 0.65 - Remote Code Execution (RCE) vulnerability CVE-2025-22630 WordPress Widget Options Plugin <= 4.1.0 - Arbitrary Code Execution vulnerability CVE-2023-6999 Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution CVE-2026-9834 WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter