CVE-2022-28927

The CVE-2022-28927 entry covers a remote code execution in Subconverter v0.7.2. The vulnerability arises from crafted config and URL parameters that allow an attacker to run arbitrary code on the affected system. The available connected documents confirm the affected software/version and the impa...

CVE-2020-35579

CVE-2020-35579 affects tindy2013 subconverter 0.6.4. The API endpoint /sub?target=%TARGET%&url=%URL%&config=%CONFIG% accepts an arbitrary URL value and issues a GET request for it, but does not account for the external request target redirecting back to the original /sub endpoint. This can create...