CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920

The Ajenti modular server admin panel (Linux & BSD) is vulnerable to local privilege escalation prior to version 2.2.16 . An authenticated user can call the /api/core/tasks/start endpoint to enqueue tasks like InstallPlugin , UnInstallPlugin , or UpgradeAll from plugins/plugins/tasks.py without t...

PerfreeBlog 安全漏洞

PerfreeBlog is PerfreeBlog open source a java-based development of blog/CMS site building platform. PerfreeBlog v4.0.11 version of a security vulnerability , the vulnerability stems from installPlugin function has a file upload vulnerability...

EUVD-2025-35861

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function...

CVE-2025-60735

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function...

PT-2025-43664

Name of the Vulnerable Software and Affected Versions PerfreeBlog version 4.0.11 Description PerfreeBlog version 4.0.11 contains a File Upload issue within the installPlugin function. This allows for potential unauthorized file uploads. Recommendations Update to a newer version that contains a fi...

CVE-2025-60735

PerfreeBlog version 4.0.11 , a Java-based blog/CMS platform, contains a File Upload vulnerability within the installPlugin function. This flaw allows for the unrestricted upload of files with dangerous types , which could lead to potential unauthorized file execution or system compromise. Remedia...

CVE-2025-60735

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function...

CVE-2025-60735

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function...

CVE-2025-60735: Unrestricted Upload of File with Dangerous Type

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function...

GHSA-C9M9-48PW-6MPV apiconnect-cli-plugins vulnerable to OS Command Injection

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the pluginUri argument. PoC js var root = require"apiconnect-cli-plugins"; var payload = "& touch Song &"; root.pluginLoader.installPluginpayload, ""; The injection point is...

OS Command Injection

strapi is vulnerable to OS Command Injection. The vulnerability exists as it does not sanitize nor validate plugin names in installPlugin and uninstallPlugin...