Skip to content
OpenAdvisories

Product · alseambusher

crontab-ui

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-72590

    alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter

    An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter.

    alseambusher crontab-ui
  • Critical 9.8
    CVE-2026-72589

    alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field

    An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files a…

    alseambusher crontab-ui