rootpwn

medium · CVSS v3 6.6 · CVSS v4 5.1 · EPSS 0.01573

CVE-2026-93965

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops…

Description

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. The attack may be initiated remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. To fix this issue, it is recommended to deploy a patch. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Scores

Severity
medium
CVSS v2
5.8
CVSS v3
6.6
CVSS v4
5.1
EPSS
0.01573

← All CVEs

Related CVEs

medium

CVE-2026-94032

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

View analysis

medium

CVE-2026-93956

A medium‑severity XSS flaw exists in olivier-ls PHP‑FTS up to 1.1.2. The vulnerability is triggered by manipulating the Query argument to SearchEngine::buildHighlights, allowing remote attackers to inject malicious scripts. It can be exploited via a web request to the affected component.

View analysis

medium

CVE-2026-92410

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.

View analysis

medium

CVE-2026-92422

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.

View analysis