CVE-2026-2752CWE-209

Navtor NavBox allows information disclosure via the /api/ais-data endpoint

Medium · published March 6, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled exception, causing the server to return verbose .NET stack traces. These error messages expose internal class names, method calls, and third-party library references (e.g., System.Data.SQLite), which may assist attackers in mapping the application's internal structure.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.8th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-03-06T15:04Z
EPSS history
Timeline
  • 06 MAR 15:04Z
    Navtor NavBox allows information disclosure via the /api/ais-data endpoint
    cvelistv5