Vulnerabilidades de Alseambusher
CVEs publicadas que afetam produtos de Alseambusher: 2 registro(s), com severidade, exploração e correções.
CVE-2026-72590
Crítica · 9.8
CWE-93 10/08/2026
alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.
CVE-2026-72589
Crítica · 9.8
CWE-78 10/08/2026
alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation.