Threats tagged 'ghsa-rvq5-4f2h-pm6w'

PocketVJ CP version 3.9.1 has a critical unauthenticated remote code execution vulnerability in the submit_opacity.php component. The flaw arises from improper sanitization of the opacityValue POST parameter, which is passed to a shell command. This allows remote attackers to execute arbitrary commands with root privileges on the affected system.