CVE-2026-27553

CVE-2026-27553 affects a web application with a diagnostics tab endpoint (/index.php/diagnostics_tab/ajax_diag_table_rows). A low-privileged remote attacker holding a valid user cookie can manipulate the schema path parameter to achieve disclosure of all user password hashes . The CNA-assigned CV...