Unrated severityNVD Advisory· Published Mar 6, 2026· Updated Mar 10, 2026
CVE-2026-2752
CVE-2026-2752
Description
Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled exception, causing the server to return verbose .NET stack traces. These error messages expose internal class names, method calls, and third-party library references (e.g., System.Data.SQLite), which may assist attackers in mapping the application's internal structure.
Affected products
2- Navtor/NavBoxv5Range: 4.12.0.3
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- www.navtor.com/navtor-vendor-statementmitrevendor-advisory
- cydome.io/vulnerability-advisory-cve-2026-2752-in-navtor-navbox-version-4-12-0-3mitretechnical-description
News mentions
0No linked articles in our index yet.