CVE-2026-32989 — Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload
Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests to a profile upda…
Published: 2026-03-20 · CVSS: 8.6 · CVSS 4.0
Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to submit crafted requests to a profile update endpoint handling file uploads. Attackers can exploit this to upload executable files to web-accessible locations, leading to arbitrary code execution in the context of the web server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7