Apache Kylin 3.0.1 - Command Injection Vulnerability

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. id: CVE-2020-1956 info: name: Apache Kylin 3.0.1 - Command Injecti...

CVE-2020-13925

CVE-2020-13925 Environment Setup Refer to https://github.com/apache/kylin to deploy using Docker, and change the version to 3.0.1 the vulnerable version. You can remove -m 8G \ it controls the allocated memory size. Then visit http://host:7070/kylin/login. The default username and password are...

apache_kylin

Apache Kylin Codacy Badge Extreme OLAP Engine for Big Data Apache Kylin is an open source Distributed Analytics Engine, contributed by eBay Inc., provides SQL interface and multi-dimensional analysis OLAP on Hadoop supporting extremely large datasets. For more details, see the website...

CVE-2026-46300

Security Research & Legal Disclaimer This repository is for educational and authorized security research purposes only. Permitted Use Understanding security vulnerabilities and exploitation concepts in controlled environments local VMs, isolated labs Studying sandbox isolation mechanisms and thei...

CVE-2020-13937

CVE-2020-13937 1. Vulnerability Description： Apache Kylin has a RESTful API that exposes configuration information without any authentication. 2. Reproduction Vulnerable comparison Non-vulnerable comparison Writing PoC Verify correct single URL: pocsuite -r CVE-2022-26134.py -u url Verify...

CVE-2020-1956

CVE-2020-1956 CVE-2020-1956 Apache Kylin exploits Kylin 2.3.0-2.3.2,Kylin 2.4.0-2.4.1,Kylin 2.5.0-2.5.2,Kylin 2.6.0-2.6.5,Kylin 3.0.0-alpha,Kylin 3.0.0-alpha2,Kylin 3.0.0-beta,Kylin 3.0.0-3.0.1 and admin competence...

CVE-2020-13937

Description Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information...

CVE-2020-13937

Apache Kylin API Unauthorized Access Vulnerability CVE-2020-13937 Fofa:title="Kylin" Usage Help: python3 cve-2020-13937.py --help Single target: python3 cve-2020-13937.py -u http://127.0.0.1 Batch scan: python3 cve-2020-13937.py -f target.txt...

CVE-2026-86152

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely...

CVE-2026-86152 Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely...

EUVD-2026-72037

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely...

CVE-2026-86152 Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely...

CVE-2026-86152

CVE-2026-86152 is a remotely exploitable OS command injection in Tenda CP3 (version 27.5.57.101). The vulnerable element is the function CAutoAddWifi::ThreadProc within the file Functions/AutoAddWifi.cpp , part of the Kylin component. An unauthenticated remote attacker can trigger the flaw with l...

EUVD-2026-72030

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely...

CVE-2026-86152: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely...

PT-2026-86464

Name of the Vulnerable Software and Affected Versions Tenda CP3 version 27.5.57.101 Description A flaw in the Kylin component allows for remote OS command injection. The issue exists within the CAutoAddWifi::ThreadProc function located in the Functions/AutoAddWifi.cpp file. Recommendations At the...

CVE-2026-86148

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely...

CVE-2026-86148

CVE-2026-86148 affects Tenda CP3 firmware 27.5.57.101 , specifically the SystemAsh function in Apis/system.c within the Kylin component. An attacker can remotely manipulate the AlarmVoiceURL argument to achieve OS command injection . The CVSS 3.1 base score is 9.1 (Critical) , with high privilege...

CVE-2026-86148 Tenda CP3 Kylin system.c SystemAsh os command injection

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely...

CVE-2026-86148 Tenda CP3 Kylin system.c SystemAsh os command injection

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely...