Threats tagged 'ghsa-6fgf-7rxh-228q'

XWEB EVO versions 5.2.3 through before 5.7.0 contain a critical pre-authentication OS command injection vulnerability. This flaw allows unauthenticated remote attackers to execute arbitrary operating system commands by injecting shell metacharacters into the username field of certain scripts before password verification. Exploitation combined with the setuid-root wlua interpreter enables attackers to run commands with root privileges, leading to full system compromise. The product line reached end of service in March 2026.