CVE-2026-124013

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua importpreconfiguration and restore actions, where serverurl and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject...

CVE-2026-124007

XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into...

CVE-2026-124002

XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the...

CVE-2026-124013

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua importpreconfiguration and restore actions, where serverurl and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject...

CVE-2026-124007

XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into...

CVE-2026-124007 Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field

XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into...

CVE-2026-124002 Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Username

XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the...

CVE-2026-124002

Dixell/Copeland XWEB EVO (versions 5.2.3 through before 5.7.0) is vulnerable to a pre-authentication OS command injection flaw. The vulnerability exists because the application fails to properly neutralize shell metacharacters in the username field of login.lua , cleanout.lua , or api.lua before ...

EUVD-2026-124635

XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the...