Live › vulnerability › CVE-2026-110970
Płatnik, a Polish payroll and social-insurance reporting application, downloads its updates, libraries and support files over unencrypted HTTP. An attacker on the network path can read the transmitted data and swap in their own files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Organisations that run Płatnik on their own machines and fetch updates or support files from the vendor's servers over a network an attacker could sit on. The sources do not describe further conditions, so the exact exposed configurations are unknown.
No product ranges from the sources yet.
http:// addresses.10.02.002 with metric 242 is stated as the fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own.
This issue was fixed in metric 242 in version 10.02.002.
This page as .md · .json · in your agent: get_signal("CVE-2026-110970")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.