Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
Impact
Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44 has an os command injection vulnerability in the Replication Receiver component. The issue is due to a flaw in the /rps/api/json/UpdateReceivers.do file. It may be possible to launch the attack remotely.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Ahsay · VulDB
AhsayCBS
117 ranges
Ahsay · VulDB
AhsayCBS
Compare with this publisher’s ranges. This does not inspect your installation.
affected
9.15.2.0
9.15.2.1
9.15.2.2
9.15.2.3
9.15.2.4
9.15.2.5
9.15.2.6
9.15.2.7
9.15.2.8
9.15.2.9
9.15.2.10
9.15.2.11
9.15.2.12
9.15.2.13
9.15.2.14
9.15.2.15
9.15.2.16
9.15.2.17
9.15.2.18
9.15.2.19
9.15.2.20
9.15.2.21
9.15.2.22
9.15.2.23
9.15.2.24
9.15.2.25
9.15.2.26
9.15.2.27
9.15.2.28
9.15.2.29
9.15.2.30
9.15.2.31
9.15.2.32
9.15.2.33
9.15.2.34
9.15.2.35
9.15.2.36
9.15.2.37
9.15.2.38
9.15.2.39
9.15.2.40
9.15.2.41
9.15.2.42
9.15.2.43
9.15.2.44
9.15.2.45
9.15.2.46
9.15.2.47
9.15.2.48
9.15.2.49
9.15.2.50
9.15.2.51
9.15.2.52
9.15.2.53
9.15.2.54
9.15.2.55
9.15.2.56
9.15.2.57
9.15.2.58
9.15.2.59
9.15.2.60
9.15.2.61
9.15.2.62
9.15.2.63
9.15.2.64
9.15.2.65
9.15.2.66
9.15.2.67
9.15.2.68
9.15.2.69
10.3.4.0
10.3.4.1
10.3.4.2
10.3.4.3
10.3.4.4
10.3.4.5
10.3.4.6
10.3.4.7
10.3.4.8
10.3.4.9
10.3.4.10
10.3.4.11
10.3.4.12
10.3.4.13
10.3.4.14
10.3.4.15
10.3.4.16
10.3.4.17
10.3.4.18
10.3.4.19
10.3.4.20
10.3.4.21
10.3.4.22
10.3.4.23
10.3.4.24
10.3.4.25
10.3.4.26
10.3.4.27
10.3.4.28
10.3.4.29
10.3.4.30
10.3.4.31
10.3.4.32
10.3.4.33
10.3.4.34
10.3.4.35
10.3.4.36
10.3.4.37
10.3.4.38
10.3.4.39
10.3.4.40
10.3.4.41
10.3.4.42
10.3.4.43
10.3.4.44
unaffected
9.15.2.70
10.3.4.45
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:ahsay:ahsaycbs:*:*:*:*:*:*:*:*Original source description
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-105134View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.