{"vulnerability": "CVE-2026-49827", "sightings": [{"uuid": "b031e2ab-e774-47e3-b5b4-f63845c51145", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-49827", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117088441310734712", "content": "CVE-2026-49827: SMEWebify WebErpMesv2 \u22641.19 has a CRITICAL vuln \u2014 improper input validation lets any self-registered user achieve unauth'd RCE via PHP file upload (scan_file param). Patch with commit 5c54862fa044b363fd2be03d586750e81afd6818 https://radar.offseq.com/threat/cve-2026-49827-cwe-20-improper-input-validation-in-smewebify-weberpmesv2-aa8118e842cafb70 #OffSeq #CVE202649827 #infosec", "creation_timestamp": "2026-08-13T13:30:28.346074Z"}, {"uuid": "471fe7cf-bd9a-4f02-b799-03fe3cc10cac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-49827", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3msxquljl252n", "content": "SMEWebify WebErpMesv2 \u22641.19 CRITICAL flaw: unauthenticated RCE possible via PHP upload in HR Expense. Patch now with commit 5c54862fa044b363fd2be03d586750e81afd6818 https://radar.offseq.com/threat/cve-2026-49827-cwe-20-improper-input-validation-in-smewebify-weberpmesv2-aa8118e842cafb70 #OffSeq #C...", "creation_timestamp": "2026-08-13T13:30:30.092656Z"}, {"uuid": "6c7c63de-98ec-4b24-961a-4f6f8a524010", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49827", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msxsm26xxa2o", "content": "\ud83d\udd34 CVE-2026-49827 - Critical (9.8)\n\nWebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Version...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-49827/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-13T14:01:31.349157Z"}, {"uuid": "6e0847ee-9eee-4f9b-82b9-ccb0adbe4d89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49827", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxt3ecoeu2e", "content": "CVE-2026-49827\nVersions 1.19 and earlier of WebErpMesv2's HR Expense feature allow anyone to upload their own PHP files, potentially allowing an attacker to execute their own code on the system. This is a concern because it\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-13T14:10:04.750834Z"}]}