CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter
CVSS
8.8
Alto
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 28 ago 2026 · Última mod.: 28 ago 2026 · CWE-78
Sin historial EPSS suficiente todavía.
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
- github.comhttps://github.com/ZoneMinder/zoneminder
- github.comhttps://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3
- github.comhttps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-02.json
- www.cisa.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02
- zoneminder.comhttps://zoneminder.com/downloads
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-820829.8 CRÍ—
——0NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.14hCVE-2026-388227.6 ALT—
——0In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.17hCVE-2026-388208.3 ALT—
——0openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.17hCVE-2026-780378.8 ALT—
——0Xiiaozet LK100W is vulnerable to OS command injection through its
web-based management interface. An authenticated attacker may be able to
execute arbitrary operating system commands with elevated privileges,
potentially resulting in unauthorized access to sensitive information or
complete device compromise.19hCVE-2026-816987.5 ALT—
——0openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.23hCVE-2026-810978.4 ALT—
——0The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell, executing commands as the account running the server and outside the guarded methods. The denylist was introduced with the tool in 1.4.0 and never covered those entry points through 1.6.0. Version 1.6.1 restricts the requires the sandbox permits to a data-only list and blocks dynamic dispatch to execution entry points; 2.0.0 removes the tool.1d