CVE-2026-27626 OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check checkShellArgumentSafety blocks several dangerous argument types but not password. A user supplying a password-typed argument can inject shell...

The vulnerability in the dmin/run-movepass.php script of the OpenRapid RapidCMS CMS system allows a hacker to increase their privileges.

The vulnerability of the dmin/run-movepass.php script in the OpenRapid RapidCMS CMS system involves manipulating password arguments, resulting in an unreliable password recovery process. Exploiting this vulnerability could allow a malicious user, who has been removed from the system, to gain...