Threat database

CVE-2026-105099 is a cross-site scripting (XSS) vulnerability in the Omega Solution CoinEx Crypto 2025 product. The flaw exists in an unknown functionality of the /user/ticket file within the Ticket Attachment Upload component. The vulnerability can be exploited remotely and requires low attack complexity with partial user interaction. The product website is no longer available, and the vendor did not respond to disclosure attempts. No patch or remediation information is available.

CVE-2026-105098 is an information disclosure vulnerability in Omega Solution CoinEx Crypto 2025. It affects an unknown function within the Support Ticket API component, specifically the /ticket/customer file. The flaw arises from manipulation of the status, page, or count arguments, allowing remote attackers to disclose information. The product appears to be retired or replaced, and the vendor has not responded to disclosure attempts. No patch or remediation is currently available.

CVE-2026-94152 is a medium severity authorization bypass vulnerability in Omega Solution's FBP Fulfillment by People 2025 product. It affects an unspecified function within the User Profile API component, specifically the /user/ file. The vulnerability arises from manipulation of the ID argument, allowing unauthorized access. Remote exploitation is possible, and public exploit details have been disclosed. The vendor has not responded to the disclosure and no patch or remediation is currently available.

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource identifiers. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.