CVE-2021-47694 Nagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test Command

The Core Config Manager CCM in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting XSS vulnerability via the Test Command functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary...

CVE-2021-47694 Nagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test Command

The Core Config Manager CCM in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting XSS vulnerability via the Test Command functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary...

CVE-2020-36856 Nagios XI < 5.6.14 Authenticated RCE command_test.php via address

Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM commandtest.php script. Insufficient validation of the address parameter allows an authenticated user with access to the Core Config Manager to inject shell metacharacters that are...

CVE-2020-36856 Nagios XI < 5.6.14 Authenticated RCE command_test.php via address

Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM commandtest.php script. Insufficient validation of the address parameter allows an authenticated user with access to the Core Config Manager to inject shell metacharacters that are...

GHSA-F9F4-5859-29MF sqls-server/sqls is vulnerable to command injection in the config command

sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands. This issue has been patched via commit...

sqls-server/sqls is vulnerable to command injection in the config command

sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands. This issue has been patched via commit...

EUVD-2025-37196

sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the openEditor function when the EDITOR environment variable and configuration file path that are passed unsanitized to a shell command. An attacker can execute arbitrary system commands by manipulating the EDITOR...

CVE-2025-61141

sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands...

EUVD-2025-37074

Malicious code in epic-webpack-config npm...

MAL-2025-49219 Malicious code in epic-webpack-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fa7e318158dc990d050f69f3aa76ec1637211eefb765d1f9db26661f69c3c70 The package epic-webpack-config was found to contain malicious code...

MAL-2025-49238 Malicious code in ssp-config-management-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db3d336f799326b6b1dfcbb9485d62b5d02423f9c6a7e7dbb4c29940c22e0ef5 The package ssp-config-management-tool was found to contain malicious code...

EUVD-2025-37070

Malicious code in eslint-config-epic npm...

EUVD-2025-37167

Malicious code in epic-config npm...

Malicious code in epic-webpack-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fa7e318158dc990d050f69f3aa76ec1637211eefb765d1f9db26661f69c3c70 The package epic-webpack-config was found to contain malicious code...

EUVD-2025-37052

Malicious code in store-webpack-config npm...

EUVD-2025-37055

Malicious code in ssp-config-management-tool npm...

Malicious code in ssp-config-management-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db3d336f799326b6b1dfcbb9485d62b5d02423f9c6a7e7dbb4c29940c22e0ef5 The package ssp-config-management-tool was found to contain malicious code...

Malicious code in epic-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 512b2df44075983b7f2a23a8151b414a43cb02a59ab726e6ba6db3c6c4874d01 The package epic-config was found to contain malicious code...

MAL-2025-49223 Malicious code in eslint-config-epic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54a940b131e34a7fd4881d3b0bed0278b40743fa28bb8aa336df89830a6b038d The package eslint-config-epic was found to contain malicious code...