Threats tagged 'ghsa-r4j6-x8h7-4f8w'

An OS command injection vulnerability exists in alseambusher/crontab-ui through version 0.4.2. This flaw allows an unauthenticated remote attacker to execute arbitrary system commands by importing a specially crafted crontab database file via the POST /import endpoint, which accepts arbitrary .db files and overwrites the application database without validation. The vulnerability has a critical severity with a CVSS score of 9.8.