CVE-2026-46624 Twenty: SQL Injection via the timeZone field

Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution RCE vulnerability exists in Twenty CRM via a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack. If Postgres user is a super user then any authenticated user can execute arbitrary OS commands on the...

CVE-2020-14293

confdatetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field obtained from the web interface...

PT-2020-13960

Name of the Vulnerable Software and Affected Versions Secudos DOMOS version 5.8 Description The issue allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field, which can be obtained from the web interface. This is related to the conf datetime in...