63 matches found
CVE-2026-62965
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...
Linux Distros Unpatched Vulnerability : CVE-2026-62965
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value paramet...
DEBIAN-CVE-2026-62965
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...
CVE-2026-62965
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...
CVE-2026-62965
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...
CVE-2026-62965 SABnzbd: Orphan-job path traversal permits arbitrary file deletion
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...
CVE-2026-62965
SABnzbd, an open source automated Usenet download tool, is vulnerable to a path traversal issue in its orphan-job management prior to version 5.1.0Beta3 . The flaw exists in sabnzbd/api.py, where the value parameter is accepted without path confinement before being used in os.path.join() with dow...
CVE-2026-62965 SABnzbd: Orphan-job path traversal permits arbitrary file deletion
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...
EUVD-2026-114468
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...
PT-2026-134210
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with download dir. An absolute path discards that base directory. An attacker with a vali...
CVE-2026-62965: sabnzbd: SABnzbd is an open source automated Usenet download tool
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...
SABnzbd Quick-Start Wizard - Exposure Detection
Default installation wizard page of SABnzbd was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Default installation wizard page of SABnzbd was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...
SABnzbd - Unauthenticated Web Interface Access Detection
Detected SABnzbd found with the web interface accessible without authentication. The config page is exposed without login, leaking the API key, config file path, server parameters, and system information to unauthenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SABnzbd found...
EUVD-2021-16087
Malware in sbrugna...
EUVD-2023-38327
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2021-29488
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the filesystem.renamer function into writing downloaded...
Linux Distros Unpatched Vulnerability : CVE-2020-13124
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary...
CVE-2023-34237
SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the Notification Script functionality allows code execution with the privileges of the SABnzbd process. Exploiting the...
CVE-2021-29488
SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the filesystem.renamer function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as part of SABnzbd 3.2.1RC1. As a workaround,...
CVE-2020-13124
SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying operating system...