Refine your search

2 vulnerabilities found for by 4xmen

CVE-2026-49849 (GCVE-0-2026-49849)
Vulnerability from cvelistv5
Published
2026-08-21 21:14
Modified
2026-08-25 16:53
Severity ?
CWE
  • CWE-434 - Unrestricted Upload of File with Dangerous Type
Summary
xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue.
Impacted products
Vendor Product Version
4xmen xshop Version: = 3.0.3
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49849",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:52:34.371148Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T16:53:16.207Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/4xmen/xshop/security/advisories/GHSA-fc35-qjg3-f6g7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xshop",
          "vendor": "4xmen",
          "versions": [
            {
              "status": "affected",
              "version": "= 3.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T21:14:24.201Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/4xmen/xshop/security/advisories/GHSA-fc35-qjg3-f6g7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/4xmen/xshop/security/advisories/GHSA-fc35-qjg3-f6g7"
        },
        {
          "name": "https://github.com/4xmen/xshop/pull/64",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/4xmen/xshop/pull/64"
        },
        {
          "name": "https://github.com/4xmen/xshop/commit/dd4a3add9d6f5b5f9dde9685e97f51057903a1db",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/4xmen/xshop/commit/dd4a3add9d6f5b5f9dde9685e97f51057903a1db"
        },
        {
          "name": "https://github.com/4xmen/xshop/releases/tag/v3.0.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/4xmen/xshop/releases/tag/v3.0.4"
        }
      ],
      "source": {
        "advisory": "GHSA-fc35-qjg3-f6g7",
        "discovery": "UNKNOWN"
      },
      "title": "xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49849",
    "datePublished": "2026-08-21T21:14:24.201Z",
    "dateReserved": "2026-06-01T22:03:19.640Z",
    "dateUpdated": "2026-08-25T16:53:16.207Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-72573 (GCVE-0-2026-72573)
Vulnerability from cvelistv5
Published
2026-08-10 10:40
Modified
2026-08-10 18:22
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary
An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.
References
Impacted products
Vendor Product Version
4xmen pm2panel Version: 0   
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72573",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T15:53:33.773598Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T18:22:59.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "pm2panel",
          "vendor": "4xmen",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bo\u0027riboy Abdurahmonov"
        }
      ],
      "datePublic": "2026-08-10T10:32:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec(\u0027pm2 restart \u0027 + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.\u003c/p\u003e"
            }
          ],
          "value": "An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec(\u0027pm2 restart \u0027 + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T10:56:39.956Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "name": "Product",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/4xmen/pm2panel"
        },
        {
          "name": "Vulnerable File",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/4xmen/pm2panel/blob/main/pm2panel.js"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-10T10:32:53.000Z",
          "value": "CVE Reserved"
        },
        {
          "lang": "en",
          "time": "2026-08-10T10:32:53.000Z",
          "value": "Public Disclosure"
        }
      ],
      "title": "4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-72573",
    "datePublished": "2026-08-10T10:40:54.998Z",
    "dateReserved": "2026-08-10T10:32:53.853Z",
    "dateUpdated": "2026-08-10T18:22:59.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}