https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:56:28 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-373270 EUVD-2026-373270 https://cve.radiocsirt.org/vuln/euvd-2026-373270 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82412 <p>ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng&#39;s CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user&#39;s browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.</p> <p>ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng&#39;s CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user&#39;s browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-82412 https://cve.radiocsirt.org/vuln/msrc_cve-2026-82412 msrc_CVE-2026-82412 https://cve.radiocsirt.org/vuln/msrc_cve-2026-82412 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-82412 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: ntopng, Ubuntu:Pro:18.04:LTS: ntopng, Ubuntu:20.04:LTS: ntopng, Ubuntu:22.04:LTS: ntopng, Ubuntu:24.04:LTS: ntopng</p> <p>ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng&#39;s CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user&#39;s browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: ntopng, Ubuntu:Pro:18.04:LTS: ntopng, Ubuntu:20.04:LTS: ntopng, Ubuntu:22.04:LTS: ntopng, Ubuntu:24.04:LTS: ntopng</p> <p>ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng&#39;s CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user&#39;s browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-82412