Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Datiphy Data Management Center lets admin run any system command

CVE-2026-76156 · published 1 month ago
Summary

Versions of Datiphy Data Management Center from 8.3.0 to 8.5.1 let a signed‑in administrator run any command on the server, giving them full control over the machine. This could be used to view, change, or delete data and to install other software. Apply the latest update from the vendor and restrict administrator accounts to only those who truly need them.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
datiphy inc. data management center <= v8.5.1
Original advisory text
Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.
References
Severity
9.4 Critical
CVSS 4.0: 9.4 (NVD)
Exploitation
EPSS 1%
Type
CWE-78OS Command Injection
Timeline
Published21 Aug 2026
Updated27 Sep 2026
First seen21 Aug 2026
Sources
CVE-2026-76156 · NVD
CVE-2026-76156 · MITRE
Track software like this
Free during beta