Alseambusher Crontab-ui vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Alseambusher Crontab-ui: 2 record(s), with affected versions and fixes.
CVE-2026-72590
Critical · 9.8
CWE-93 Aug 10, 2026
alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.
CVE-2026-72589
Critical · 9.8
CWE-78 Aug 10, 2026
alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation.