CVE-2026-27626 OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check checkShellArgumentSafety blocks several dangerous argument types but not password. A user supplying a password-typed argument can inject shell...

OpenRapid RapidCMS Privilege Escalation

The vulnerability of the dmin/run-movepass.php script in the OpenRapid RapidCMS CMS system involves manipulating password arguments, resulting in an unreliable password recovery process. Exploiting this vulnerability could allow a malicious user, who has been removed from the system, to gain...