PYSEC-2026-2665 motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution

Summary The ActionHandler.post method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts PTZ controls, alarm triggers, etc.. Vulnerability Details File:...

motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution

SummaryThe ActionHandler.post method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts PTZ controls, alarm triggers, etc.. Vulnerability DetailsFile:...

PT-2026-59314

Summary The ActionHandler.post method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts PTZ controls, alarm triggers, etc.. Vulnerability Details File:...

CVE-2026-23920 Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

Host and event action script input is validated with a regex set by the administrator, but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands...

CVE-2025-70146

Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations e.g.,adding records, deleting records via direct HTTP requests to affected endpoints without a...

CVE-2025-70146

The ProjectWorlds Online Time Table Generator 1.0 is vulnerable to an authentication bypass in multiple administrative action scripts located under the /admin/ directory. This security flaw allows remote attackers to perform unauthorized administrative operations, such as adding or deleting recor...

VulnCheck KEV: CVE-2022-28054

Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value...

EUVD-2022-32540

Malicious code in bioql PyPI...

CVE-2022-28054

Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value...

SUSE CVE-2014-3686

wpasupplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpacli or hostapdcli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame...

CVE-2022-28054

Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value...

CVE-2022-28054

Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value...

CVE-2022-28054

Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value...

CVE-2022-28054

The CVE-2022-28054 entry affects VanDyke Software VShell for Windows 4.6.2. The root cause is improper sanitization/cleanup of trigger action scripts, which enables an attacker to execute arbitrary code by supplying a crafted value. Impact is high: remote code execution with network access and no...

CVE-2022-28054

Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value...

VanDyke Software VShell for Windows 安全漏洞

VanDyke Software VShell for Windows is used for multi-protocol secure file transfer by USA Vandyke Software. A security vulnerability exists in VanDyke Software VShell for Windows version 4.6.2, which originates from improper cleanup of trigger action scripts. An attacker could exploit the...

PT-2022-18781 · Vandyke · Vshell For Windows

Name of the Vulnerable Software and Affected Versions: VanDyke Software VShell for Windows version 4.6.2 Description: The issue is related to improper sanitization of trigger action scripts, allowing attackers to execute arbitrary code via a crafted value. Recommendations: For VanDyke Software...

CVE-2022-28054: Undefined Security Weakness

Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value...

Microsoft Windows Server Elevation of Privilege Vulnerability (CNVD-2015-04664)

Microsoft Windows Server is a series of servers based on the windows operating system launched by the U.S. Microsoft Microsoft. A security vulnerability exists in the Windows Installer service for Microsoft Windows. A local attacker can exploit the vulnerability to gain privileges via custom acti...

Debian DLA-147-1 : wpasupplicant security update

It was discovered that wpasupplicant could be tricked into executing arbitrary commands when calling action scripts. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as...