CVE-2026-73328

The Volmarg Personal Management System (through version 2.1.0 ) contains an unrestricted file upload vulnerability in the /upload/send/ endpoint. This flaw allows authenticated users to upload malicious PHP files by submitting base64 encoded content with a .php filename into the web root. Success...

CVE-2026-119742 Nagios XI < 2026R2 OS Command Injection via mibs.php

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

EUVD-2026-115824

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

CVE-2026-119742

Nagios XI versions prior to 2026R2 are vulnerable to an OS command injection flaw in the MIB upload feature. The root cause is located in the install_mib() function within mibs.php, which employs an incomplete character deny-list that fails to filter semicolons and pipes. An authenticated adminis...

CVE-2026-61564

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-61567

AVideo, a video-sharing platform, contains a critical vulnerability in the view/videosListToLive.php endpoint prior to version 8.1.0 . An unauthenticated remote attacker can self-grant isLogged and canStream status by providing a controlled webSiteRootURL, as the system trusts the returned JSON a...

CVE-2026-61564

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint "install/checkConfiguration.php" assembles "videos/configuration.php" by interpolating request parameters, including "webSiteRootURL", into single-quoted PHP string literals without escaping. An attacker ca...

CVE-2026-61564

The AVideo video-sharing platform is vulnerable to PHP code injection and SQL injection in the unauthenticated installer endpoint install/checkConfiguration.php prior to version 8.1.0 . The root cause is the lack of escaping when interpolating request parameters, such as webSiteRootURL, into sing...

CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

Linux Distros Unpatched Vulnerability : CVE-2026-116219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the...

Dariusz Personal Management System Backend command injection vulnerability

Versions 2.1.0 and earlier of the Dariusz Personal Management System Backend contain a command injection vulnerability. This vulnerability arises because the tree command in the storage module fails to escape folder paths. Authentication-authorized attackers can create directories containing shel...

CVE-2026-116219

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...

EUVD-2026-109811

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...

CVE-2026-116219 Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...

CVE-2026-116219

Dolibarr ERP CRM versions before 24.0.0 are vulnerable to an OS command injection in htdocs/admin/tools/export.php. This vulnerability allows authenticated administrators to bypass the restrict_os_commands allowlist by submitting a mysqldump value with command chaining characters (e.g., &) placed...

Dolibarr command injection vulnerability

Versions of Dolibarr prior to 24.0.0 contain a command injection vulnerability. This vulnerability stems from an OS command injection issue in htdocs/admin/tools/export.php. Authenticated administrators can bypass the restrictoscommands allow list by crafting mysqldump values and using & characte...

PT-2026-123328

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict os commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basenam...

Linux Distros Unpatched Vulnerability : CVE-2026-102608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single...