CVE-2026-82804

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

org.apache.dolphinscheduler:dolphinscheduler-alert-all (>=3.2.0, <=3.4.2), org.apache.dolphinscheduler:dolphinscheduler-alert-server (>=2.0.1, <=3.4.2) +2 more potentially affected by CVE-2026-82804 via org.apache.dolphinscheduler:dolphinscheduler-alert-script (>=2.0.1, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-alert-script MAVEN version =2.0.1, =3.2.0, =2.0.1, =2.0.1, =2.0.1, =3.0.6 Source cves: CVE-2026-82804 Source advisory: MEND:CVE-2026-82804...

CVE-2026-82804

The Apache DolphinScheduler (versions before 3.4.3 ) is vulnerable to command injection in the Alert Script plugin . The root cause is the incorporation of the scriptPath parameter into a /bin/sh -c command without sufficient neutralization of shell metacharacters. An authenticated user can explo...

CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

EUVD-2026-88812

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-82804: Improper Neutralization of Special Elements used in an OS Command

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

PT-2026-102608

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

GHSA-3VCP-R62V-XPVG Apache DolphinScheduler vulnerable to Alert Script Attack

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue...

org.apache.dolphinscheduler:dolphinscheduler-alert-all (>=3.2.0, <=3.3.0-alpha), org.apache.dolphinscheduler:dolphinscheduler-alert-server (>=3.0.0-alpha, <=3.3.0-alpha) +1 more potentially affected by CVE-2024-43115 via org.apache.dolphinscheduler:dolphinscheduler-alert-script (>=3.0.0-alpha, <=3.3.0-alpha)

org.apache.dolphinscheduler:dolphinscheduler-alert-script MAVEN version =3.0.0-alpha, =3.2.0, =3.0.0-alpha, =3.0.0-alpha, =3.0.6 Source cves: CVE-2024-43115 Source advisory: SNYK:JAVA-ORGAPACHEDOLPHINSCHEDULER-12840399...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to improper input validation in the alert script check. An attacker can execute arbitrary shell commands on the server by submitting crafted input after authentication. Remediation Upgrade...

Apache DolphinScheduler vulnerable to Alert Script Attack

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue...

CVE-2024-43115

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue...

CVE-2024-43115 Apache DolphinScheduler: Alert Script Attack

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue...

org.apache.dolphinscheduler:dolphinscheduler-alert-all (>=3.2.0, <=3.2.1), org.apache.dolphinscheduler:dolphinscheduler-alert-server (>=2.0.1, <=3.2.1) +2 more potentially affected by CVE-2024-43115 via org.apache.dolphinscheduler:dolphinscheduler-alert-script (>=2.0.1, <=3.2.1)

org.apache.dolphinscheduler:dolphinscheduler-alert-script MAVEN version =2.0.1, =3.2.0, =2.0.1, =2.0.1, =2.0.1, =3.0.6 Source cves: CVE-2024-43115 Source advisory: MEND:CVE-2024-43115...

CVE-2024-43115

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue...

CVE-2024-43115 Apache DolphinScheduler: Alert Script Attack

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue...

CVE-2024-43115

Apache DolphinScheduler is vulnerable to Remote Code Execution (RCE) due to improper input validation within the alert script check. An authenticated user can submit crafted input to execute arbitrary shell commands on the server. This issue affects versions prior to 3.2.2 . Remediation requires ...

CVE-2024-51941: Improper Control of Generation of Code

A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code. The vulnerability occurs when processing alert definitions, where malicious input can be injected into the alert script execution path. An...

Welcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks PoC add new payment method with XSS exploit: fetch'http://localhost/tester-wp/wp-admin/admin-ajax.php', method: 'POST', headers: ne...