Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by 4xmen
CVE-2026-49849 (GCVE-0-2026-49849)
Vulnerability from nvd – Published: 2026-08-21 21:14 – Updated: 2026-08-25 16:53
VLAI
EPSS
VEX
Title
xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution
Summary
xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 16:52 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/4xmen/xshop/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/4xmen/xshop/pull/64 | x_refsource_MISC |
| https://github.com/4xmen/xshop/commit/dd4a3add9d6… | x_refsource_MISC |
| https://github.com/4xmen/xshop/releases/tag/v3.0.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49849",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T16:52:34.371148Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T16:53:16.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/4xmen/xshop/security/advisories/GHSA-fc35-qjg3-f6g7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "xshop",
"vendor": "4xmen",
"versions": [
{
"status": "affected",
"version": "= 3.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:14:24.201Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/4xmen/xshop/security/advisories/GHSA-fc35-qjg3-f6g7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/4xmen/xshop/security/advisories/GHSA-fc35-qjg3-f6g7"
},
{
"name": "https://github.com/4xmen/xshop/pull/64",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/4xmen/xshop/pull/64"
},
{
"name": "https://github.com/4xmen/xshop/commit/dd4a3add9d6f5b5f9dde9685e97f51057903a1db",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/4xmen/xshop/commit/dd4a3add9d6f5b5f9dde9685e97f51057903a1db"
},
{
"name": "https://github.com/4xmen/xshop/releases/tag/v3.0.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/4xmen/xshop/releases/tag/v3.0.4"
}
],
"source": {
"advisory": "GHSA-fc35-qjg3-f6g7",
"discovery": "UNKNOWN"
},
"title": "xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49849",
"datePublished": "2026-08-21T21:14:24.201Z",
"dateReserved": "2026-06-01T22:03:19.640Z",
"dateUpdated": "2026-08-25T16:53:16.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72573 (GCVE-0-2026-72573)
Vulnerability from nvd – Published: 2026-08-10 10:40 – Updated: 2026-08-10 18:22
VLAI
EPSS
VEX
Title
4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter
Summary
An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 15:53 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/4xmen/pm2panel | third-party-advisory |
| https://github.com/4xmen/pm2panel/blob/main/pm2panel.js | technical-description |
Date Public
2026-08-10 10:32
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72573",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T15:53:33.773598Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T18:22:59.699Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "pm2panel",
"vendor": "4xmen",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bo\u0027riboy Abdurahmonov"
}
],
"datePublic": "2026-08-10T10:32:53.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec(\u0027pm2 restart \u0027 + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.\u003c/p\u003e"
}
],
"value": "An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec(\u0027pm2 restart \u0027 + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T10:56:39.956Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Product",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/4xmen/pm2panel"
},
{
"name": "Vulnerable File",
"tags": [
"technical-description"
],
"url": "https://github.com/4xmen/pm2panel/blob/main/pm2panel.js"
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-10T10:32:53.000Z",
"value": "CVE Reserved"
},
{
"lang": "en",
"time": "2026-08-10T10:32:53.000Z",
"value": "Public Disclosure"
}
],
"title": "4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72573",
"datePublished": "2026-08-10T10:40:54.998Z",
"dateReserved": "2026-08-10T10:32:53.853Z",
"dateUpdated": "2026-08-10T18:22:59.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49849 (GCVE-0-2026-49849)
Vulnerability from cvelistv5 – Published: 2026-08-21 21:14 – Updated: 2026-08-25 16:53
VLAI
EPSS
VEX
Title
xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution
Summary
xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 16:52 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/4xmen/xshop/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/4xmen/xshop/pull/64 | x_refsource_MISC |
| https://github.com/4xmen/xshop/commit/dd4a3add9d6… | x_refsource_MISC |
| https://github.com/4xmen/xshop/releases/tag/v3.0.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49849",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T16:52:34.371148Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T16:53:16.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/4xmen/xshop/security/advisories/GHSA-fc35-qjg3-f6g7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "xshop",
"vendor": "4xmen",
"versions": [
{
"status": "affected",
"version": "= 3.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:14:24.201Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/4xmen/xshop/security/advisories/GHSA-fc35-qjg3-f6g7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/4xmen/xshop/security/advisories/GHSA-fc35-qjg3-f6g7"
},
{
"name": "https://github.com/4xmen/xshop/pull/64",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/4xmen/xshop/pull/64"
},
{
"name": "https://github.com/4xmen/xshop/commit/dd4a3add9d6f5b5f9dde9685e97f51057903a1db",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/4xmen/xshop/commit/dd4a3add9d6f5b5f9dde9685e97f51057903a1db"
},
{
"name": "https://github.com/4xmen/xshop/releases/tag/v3.0.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/4xmen/xshop/releases/tag/v3.0.4"
}
],
"source": {
"advisory": "GHSA-fc35-qjg3-f6g7",
"discovery": "UNKNOWN"
},
"title": "xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49849",
"datePublished": "2026-08-21T21:14:24.201Z",
"dateReserved": "2026-06-01T22:03:19.640Z",
"dateUpdated": "2026-08-25T16:53:16.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72573 (GCVE-0-2026-72573)
Vulnerability from cvelistv5 – Published: 2026-08-10 10:40 – Updated: 2026-08-10 18:22
VLAI
EPSS
VEX
Title
4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter
Summary
An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 15:53 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/4xmen/pm2panel | third-party-advisory |
| https://github.com/4xmen/pm2panel/blob/main/pm2panel.js | technical-description |
Date Public
2026-08-10 10:32
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72573",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T15:53:33.773598Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T18:22:59.699Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "pm2panel",
"vendor": "4xmen",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bo\u0027riboy Abdurahmonov"
}
],
"datePublic": "2026-08-10T10:32:53.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec(\u0027pm2 restart \u0027 + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.\u003c/p\u003e"
}
],
"value": "An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec(\u0027pm2 restart \u0027 + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T10:56:39.956Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "Product",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/4xmen/pm2panel"
},
{
"name": "Vulnerable File",
"tags": [
"technical-description"
],
"url": "https://github.com/4xmen/pm2panel/blob/main/pm2panel.js"
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-10T10:32:53.000Z",
"value": "CVE Reserved"
},
{
"lang": "en",
"time": "2026-08-10T10:32:53.000Z",
"value": "Public Disclosure"
}
],
"title": "4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72573",
"datePublished": "2026-08-10T10:40:54.998Z",
"dateReserved": "2026-08-10T10:32:53.853Z",
"dateUpdated": "2026-08-10T18:22:59.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}