CVE-2018-19515: In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator.

Security readout for executives and security teams

Webgalamb through version 7.0 exposes administrator-only AJAX functionality to unauthenticated users under certain request conditions. This could let outsiders reach actions that should require admin access. Public sources do not provide CVSS scoring, KEV listing, or a confirmed vendor patch, so urgency depends on whether Webgalamb is internet-facing in your environment. Exposure is likely limited to organizations running Webgalamb through 7.0, especially if the application or admin paths are reachable from the internet. The source bundle does not identify CPEs, deployment prevalence, or specific downstream products. Treat this as a targeted exposure review rather than a confirmed emergency. If Webgalamb through 7.0 is public-facing, prioritize containment and vendor guidance because administrator-only functionality may be reachable without login. Mitigation focus: Identify whether Webgalamb through 7.0 is deployed or externally reachable.; Check Webgalamb vendor or maintainer guidance for a fixed release or official mitigation.; Restrict access to Webgalamb administrative and system/ajax.php paths to trusted networks..

Prepared

Jun 6, 2026, 21:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.