CVE-2023-50094 (published 2024-01-01T00:00:00)
reNgine through 2.0.2 allows OS Command Injection if an adversary has a valid session ID. The attack places shell metacharacters in an api/tools/waf_detector/?url= string. The commands are executed as root via subprocess.check_output.
Affected products: Vendor: n/a
Product: n/a
Versions: n/a