CVE-2026-28517
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application r
CVSS
9.8
Crítico
EPSS
6.3%
p94
KEV
—
Exploit Today
28
0-100
Publicado: 27 feb 2026 · Última mod.: 14 jul 2026 · CWE-78
6.3%EPSS · 30 días9.4%
2026-10-042026-11-01
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.
- chocapikk.comhttps://chocapikk.com/posts/2026/opendcim-sqli-to-rce/
- github.comhttps://github.com/Chocapikk/opendcim-exploit
- github.comhttps://github.com/opendcim/openDCIM/blob/4467e9c4/report_network_map.php#L467
- github.comhttps://github.com/opendcim/openDCIM/blob/4467e9c4/report_network_map.php#L7
- github.comhttps://github.com/opendcim/openDCIM/pull/1664
- github.comhttps://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09
- www.vulncheck.comhttps://www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-778808.4 ALT—
———Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.4hCVE-2026-778788.4 ALT—
———Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping. An attacker able to reach the route can inject arbitrary OS commands that execute as root.4hCVE-2026-778769.8 CRÍ—
———Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can exploit this flaw, which passes attacker-controlled input directly into a shell_exec call, to achieve code execution in the user panel context.4hCVE-2026-1040808.4 ALT—
———Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers can send a crafted request to the /valid_token/ route, which passes the parameter unescaped into a shell_exec() call.4hCVE-2026-736978.8 ALT—
———Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.4hCVE-2026-943498.0 ALT—
———Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.3h