CVE-2026-124013

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua importpreconfiguration and restore actions, where serverurl and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject...

CVE-2026-124010

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen,...

CVE-2026-124009

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped...

CVE-2026-124008

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit th...

CVE-2026-124007

XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into...

CVE-2026-124002

XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the...

CVE-2026-124003

XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system"/usr/bin/lua "+argv on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv...

CVE-2026-124013

The XWEB EVO product (versions 5.6.2 through 5.8.8 ) is vulnerable to an authenticated OS command injection in the api.lua file's import_preconfiguration and restore actions. The root cause is the concatenation of unescaped server_url and related server credential fields into a root curl command ...

EUVD-2026-124667

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua importpreconfiguration and restore actions, where serverurl and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject...

CVE-2026-124010

The XWEB EVO product (versions prior to 5.6.2 ) is vulnerable to a command injection vulnerability in the setuid-root CGI xwconsole.cgi . The root cause is the unsanitized passage of malicious input from the sh parameter to the popen() function. This allows unauthenticated remote attackers to exe...

CVE-2026-124010 Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgi

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen,...

EUVD-2026-124652

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen,...

CVE-2026-124009 Dixell/Copeland XWEB EVO OS Command Injection via backup.lua

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped...

CVE-2026-124009

The XWEB EVO product (versions 5.2.3 through 5.8.8 ) is vulnerable to an authenticated OS command injection vulnerability. The root cause is the unescaped concatenation of shell metacharacters into the output device path parameter processed by backup.lua. Attackers with authentication can exploit...

EUVD-2026-124651

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped...

CVE-2026-124008 Dixell/Copeland XWEB EVO OS Command Injection via devices.lua

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit th...

CVE-2026-124008

XWEB EVO versions 5.2.3 through 5.8.8 are vulnerable to an authenticated OS command injection flaw within the devices.lua template handling. The root cause is the injection of unescaped template source into unzip and related shell commands, which can be exploited via the wlua interpreter . Succes...

EUVD-2026-124650

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit th...

EUVD-2026-124649

XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into...

CVE-2026-124007

The XWEB EVO (versions before 5.6.2 ) is vulnerable to a pre-authentication OS command injection vulnerability. Unauthenticated remote attackers can execute arbitrary commands by injecting shell metacharacters into the password field . The root cause is the unescaped interpolation of the password...