{"id":"CVE-2026-8735","state":"PUBLISHED","title":"Oinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization","description":"A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component appConfigQuery Interface. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-05-17T05:15:10.410Z","updatedAt":"2026-05-18T17:53:11.193Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Oinone Pamirs"],"affected":[{"vendor":"Oinone","product":"Pamirs","versions":[{"version":"7.0","status":"affected"},{"version":"7.1","status":"affected"},{"version":"7.2.0","status":"affected"}],"cpes":["cpe:2.3:a:oinone:pamirs:*:*:*:*:*:*:*:*"],"modules":["appConfigQuery Interface"]}],"references":["https://vuldb.com/vuln/364323","https://vuldb.com/vuln/364323/cti","https://vuldb.com/submit/809887","https://github.com/SourByte05/SourByte-Lab/issues/13"],"weaknesses":["CWE-502","CWE-20"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/8xxx/CVE-2026-8735.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-8735","state":"PUBLISHED","datePublished":"2026-05-17T05:15:10.410Z","dateUpdated":"2026-05-18T17:53:11.193Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-05-16T10:30:05.343Z"},"containers":{"cna":{"title":"Oinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization","descriptions":[{"lang":"en","value":"A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component appConfigQuery Interface. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"Oinone","product":"Pamirs","versions":[{"version":"7.0","status":"affected"},{"version":"7.1","status":"affected"},{"version":"7.2.0","status":"affected"}],"cpes":["cpe:2.3:a:oinone:pamirs:*:*:*:*:*:*:*:*"],"modules":["appConfigQuery Interface"]}],"references":[{"url":"https://vuldb.com/vuln/364323","name":"VDB-364323 | Oinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/364323/cti","name":"VDB-364323 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/809887","name":"Submit #809887 | Oinone  Oinone <= 7.2.0 Fastjson Remote Code Execution","tags":["third-party-advisory"]},{"url":"https://github.com/SourByte05/SourByte-Lab/issues/13","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","type":"CWE","lang":"en","description":"Deserialization"}]},{"descriptions":[{"cweId":"CWE-20","type":"CWE","lang":"en","description":"Improper Input Validation"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-05-17T05:15:10.410Z"},"timeline":[{"time":"2026-05-16T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-05-16T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-05-16T12:35:17.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"sourbyte (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-18T16:43:56.110063Z","id":"CVE-2026-8735","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-18T17:53:11.193Z"}}]}}}