Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via incomplete sanitization of user-supplied commands in the terminal process. An attacker can execute arbitrary operating system commands as the web server user by injecting shell metacharacters such as single pipe |,...

GHSA-9643-6XJP-VX57 Pheditor has an authenticated terminal command whitelist bypass

Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command string to shellexec. Shell command substitution such as $ is not blocked...

CVE-2026-63305

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into thes...

CVE-2026-63304

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...

CVE-2026-63304

AVideo

CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...

CVE-2026-63305 AVideo through 29.0 OS Command Injection via ffmpeg.json.php

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into thes...

The vulnerability of the OCSP protocol implementation in the Apache HTTP Server allows a perpetrator to induce a service failure.

The vulnerability of the OCSP protocol implementation in the Apache HTTP Server is related to reading data beyond the permitted range of memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the mod_http2 module in the Apache HTTP Server allows a attacker to cause a service failure.

The vulnerability of the modhttp2 module in the Apache HTTP Server relates to the possibility of using memory after it is released. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

ROS-20260715-73-0007

The vulnerability of the Apache HTTP Server is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

PT-2026-60206

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http slice module module, which is enabled via the --with-http slice module configuration parameter...

The vulnerability of the Apache HTTP Server web server, related to the violation of the buffer limit, allows attackers to trigger a service failure.

The vulnerability of the Apache HTTP Server is related to a violation of the buffer limit. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service interruptions...

CVE-2026-49855

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an...

CVE-2026-47737

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...

UBUNTU-CVE-2026-47736

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends...

CVE-2026-47736 Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends...

CVE-2026-47767

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release

Red Hat JBoss Web Server 7.0 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release

Red Hat JBoss Web Server 7.0.0 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Linux Enterprise 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...