https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T08:30:22.292047+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-318280 EUVD-2026-318280 2026-10-15T08:30:22.340926+00:00 EUVD-2026-318280 https://cve.radiocsirt.org/vuln/fkie_cve-2025-34099 fkie_cve-2025-34099 2026-10-15T08:30:22.340963+00:00

An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user. NOTE: This vulnerability was mitigated in 2017.

 https://cve.radiocsirt.org/vuln/ghsa-48rx-xrhh-96jc GHSA-48rx-xrhh-96jc 2026-10-15T08:30:22.340997+00:00

An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when password encryption is enabled (a non-default configuration). The application improperly passes the HTTP Basic Authentication password directly to a call to exec() without adequate sanitation. This allows remote attackers to inject and execute arbitrary operating system commands as the web server user.