CVE-2019-10266

CVE-2019-10266 is a high-severity XML External Entity (XXE) injection vulnerability affecting Ahsay Cloud Backup Suite versions prior to 8.1.1.50. This flaw allows an unauthenticated attacker to send a specially crafted XML document to a specific URL, enabling them to read the file structure and content of arbitrary files on the affected system. With a CVSS score of 7.5 (High), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, leading to a complete compromise of confidentiality. While there is no evidence of active exploitation, public exploit code is available on ExploitDB, and its high FAUCET Risk Score of 96/100 indicates significant potential risk.