Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-72589

alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Alseambusher
Products
Crontab-ui
CVE-2026-72590

alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Alseambusher
Products
Crontab-ui