Threats tagged 'ghsa-m9wg-vhr5-756v'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Critical	9.3	CVE-2026-124010XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to Critical9.32026-11-12GCVE DatabaseCVE-2026-124010 XWEB EVO versions prior to 5.6.2 contain a critical command injection vulnerability in the setuid-root CGI xwconsole.cgi. This flaw allows unauthenticated remote attackers to execute arbitrary commands as root by supplying malicious input through the sh parameter, which is passed unsanitized to popen(). The product line is end-of-service as of March 2026. Report on CVE-2026-124010 Vulnerability CWE-78 #ghsa-m9wg-vhr5-756v	GCVE Database	2026-11-12

Page 1 of 1