# CVE-2026-113404: Uniong WebITR insecure deserialization

Source: https://junglewise.ai/threats/cve-2026-113404-webitr-developed-by-uniong-has-a-insecure-deserialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113404 · Severity: high · CVSS 8.8 · Published 2026-10-20

WebITR is an attendance management system developed by Uniong. Authenticated attackers can exploit a flaw in how the system handles serialized data by using a hardcoded encryption key to inject malicious code that runs on the server, allowing them to take complete control of the system.

Technologies: [Uniong Webitr](https://junglewise.ai/threats/technologies/webitr). Vendors: [Uniong](https://junglewise.ai/threats/vendors/uniong).

## Quick answers

**Is CVE-2026-113404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113404 being exploited in the wild.

**How severe is CVE-2026-113404?** High severity, with a CVSS score of 8.8, published 20 October 2026.

**Which products and versions are affected?** Uniong Webitr 2_1_0_34 and earlier.

**Is there a fix for CVE-2026-113404?** Yes: fixed in WebITR 2_1_0_36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113404 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-113404?** Check whether you run Uniong Webitr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in WebITR 2_1_0_36 or later

## Technical details

WebITR contains an insecure deserialization vulnerability in its cryptographic key handling. Authenticated remote attackers can craft malicious serialized data using the hardcoded cryptographic key and submit it to achieve remote code execution on the server. The vulnerability requires authentication but allows arbitrary code execution once the attacker has valid credentials.

## Affected products

- Uniong WebITR 2_1_0_34 and earlier

## Timeline

- 2026-10-20: disclosed

## References

- [https://www.twcert.org.tw/en/cp-139-11297-7c6f6-2.html](https://www.twcert.org.tw/en/cp-139-11297-7c6f6-2.html)
- [https://www.twcert.org.tw/tw/cp-132-11296-d3d95-1.html](https://www.twcert.org.tw/tw/cp-132-11296-d3d95-1.html)

## Related threats

- [WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to…](https://junglewise.ai/threats/cve-2025-13771-webitr-developed-by-uniong-has-an-arbitrary-file-read)
- [WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject…](https://junglewise.ai/threats/cve-2025-13770-webitr-developed-by-uniong-has-a-sql-injection-vulnerability)
- [WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject…](https://junglewise.ai/threats/cve-2025-13769-webitr-developed-by-uniong-has-a-sql-injection-vulnerability)
- [WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log…](https://junglewise.ai/threats/cve-2025-13768-webitr-developed-by-uniong-has-an-authentication-bypass)