Threat database

CVE-2026-39801 is a critical vulnerability in Sergey AIWU versions up to 1.5.9 that allows subscriber privilege escalation due to incorrect privilege assignment. This flaw enables an attacker to gain elevated privileges without authorization, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-65507 is a critical vulnerability in Sergey AIWU versions up to and including 1.5.6 that allows unauthenticated privilege escalation due to incorrect privilege assignment (CWE-266). This flaw enables an attacker with no prior authentication to gain elevated privileges, potentially leading to full system compromise. The vulnerability has a CVSS v3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL Injection.This issue affects AIWU: from n/a through <= 1.5.4.

Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation. This issue affects AIWU: from n/a through 1.4.17.