Skip to content
OpenAdvisories

Vendor

jhuckaby

5 known vulnerabilities.

Products

Cronicle 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-85076

    Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

    Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with run_events, create_events, or edit_events privilege can supply undeclared keys in event params through api_create_event, api…

    jhuckaby Cronicle
  • Critical 9.0
    CVE-2026-55562

    Cronicle: Stored XSS in admin Activity Log via account full_name field

    Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applyin…

    jhuckaby Cronicle