37 matches found
CVE-2026-65638
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-65639
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...
EUVD-2026-75595
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-65638
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-65638
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
EUVD-2026-75597
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...
CVE-2026-65639
ConfigServer Security & Firewall (CSF) is vulnerable to OS command injection in its advanced-rule parser . An attacker who controls a configured allow/deny feed can inject commands that execute with root privileges , due to insufficient validation of feed-supplied rule data. The vulnerability aff...
CVE-2026-65638
ConfigServer Security & Firewall (CSF) is vulnerable to shell command injection due to improper escaping of a request URL. An unauthenticated remote attacker can exploit this to execute arbitrary commands as the CSF service account. The CVSS 4.0 score is 9.2 (Critical) with a network attack vecto...
CVE-2026-65639
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...
PT-2026-89493
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...
CVE-2026-65638: Improper Neutralization of Special Elements used in an OS Command
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-65639: Improper Neutralization of Special Elements used in an OS Command
OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the...
PT-2026-89492
Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...
CVE-2026-67402: Files or Directories Accessible to External Parties
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...
CVE-2026-67402
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...
CVE-2026-67402
An insecure Apache configuration in ConfigServer Security & Firewall (CSF) by WebPros maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host . A remote unauthenticated attacker whose address is blocked by CSF can request a mapped executable and run arbitrary commands as the Apa...
PT-2026-85316
Name of the Vulnerable Software and Affected Versions ConfigServer Security & Firewall versions prior to 16.31 Description An insecure Apache configuration maps /usr/bin as CGI Common Gateway Interface programs through the Messenger v3 HTTPS virtual host. This allows a remote unauthenticated...
SUSE CVE-2026-47671
Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...
CVE-2026-47671
Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...
CVE-2026-47671
Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...