CVE Intelligence

Alseambusher vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Alseambusher products: 2 record(s), with severity, exploitation and fixes.

Crontab-ui 2

Exploited only (KEV) →

CVE-2026-72590 Critical · 9.8 CWE-93 Aug 10, 2026
alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.
CVE-2026-72589 Critical · 9.8 CWE-78 Aug 10, 2026
alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation.