https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 08:29:37 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-37912 cnvd-2020-37912 https://cve.radiocsirt.org/vuln/cnvd-2020-37912 https://cve.radiocsirt.org/vuln/euvd-2026-38055 EUVD-2026-38055 https://cve.radiocsirt.org/vuln/euvd-2026-38055 https://cve.radiocsirt.org/vuln/fkie_cve-2020-7634 <p>heroku-addonpool through 0.1.15 is vulnerable to Command Injection.</p> <p>heroku-addonpool through 0.1.15 is vulnerable to Command Injection.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-7634 https://cve.radiocsirt.org/vuln/ghsa-3q9x-w53p-jg53 <p><strong>Affected:</strong> npm: heroku-addonpool</p> <p>heroku-addonpool through 0.1.15 is vulnerable to Command Injection. The second parameter of the exported function `HerokuAddonPool(id, app, opt)` can be controlled by users without any sanitization.</p> <p>**PoC** ```js var Root = require(&#34;heroku-addonpool&#34;); var root = Root(&#34;sss&#34;, &#34;&amp; touch JHU&#34;, {}); root.setup(); ```</p> <p><strong>Affected:</strong> npm: heroku-addonpool</p> <p>heroku-addonpool through 0.1.15 is vulnerable to Command Injection. The second parameter of the exported function `HerokuAddonPool(id, app, opt)` can be controlled by users without any sanitization.</p> <p>**PoC** ```js var Root = require(&#34;heroku-addonpool&#34;); var root = Root(&#34;sss&#34;, &#34;&amp; touch JHU&#34;, {}); root.setup(); ```</p> https://cve.radiocsirt.org/vuln/ghsa-3q9x-w53p-jg53 https://cve.radiocsirt.org/vuln/gsd-2020-7634 gsd-2020-7634 https://cve.radiocsirt.org/vuln/gsd-2020-7634