https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 05:32:31 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-118992 <p>CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.</p> <p>restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.</p> <p>Anyone who can supply a backup to be restored can run arbitrary commands as the application user.</p> <p>CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.</p> <p>restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.</p> <p>Anyone who can supply a backup to be restored can run arbitrary commands as the application user.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118992 https://db.gcve.eu/vuln/ghsa-w32m-6wp6-8542 <p>CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.</p> <p>restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.</p> <p>Anyone who can supply a backup to be restored can run arbitrary commands as the application user.</p> <p>CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup.</p> <p>restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell runs lines starting with a dot as its own commands, so .shell or .system in the dump runs an OS command and .load loads native code.</p> <p>Anyone who can supply a backup to be restored can run arbitrary commands as the application user.</p> https://db.gcve.eu/vuln/ghsa-w32m-6wp6-8542