CVE-2026-72590 alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

PT-2026-69473

Name of the Vulnerable Software and Affected Versions alseambusher/crontab-ui versions prior to 0.4.3 Description An OS command injection allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The 'POST /import' endpoint accept...

PT-2026-69474

Name of the Vulnerable Software and Affected Versions alseambusher/crontab-ui versions prior to 0.4.3 Description An OS command injection flaw allows an unauthenticated remote attacker to inject arbitrary cron job entries. This occurs when a crafted GET request is sent to the '/crontab' endpoint...

CVE-2026-72589: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

CVE-2026-72590: Improper Neutralization of CRLF Sequences

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...