Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: nuxsmin Clear all filters
TI-2026-45313 CVE-2026-63725 · GHSA-cqxp-cq56-pxvr

sysPass FileBackupService Authenticated OS Command Injection via Backup Path

Priority HIGH 72

sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the comm…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00444 Published 2026-08-06 No fix listed CWE-78
TI-2026-46845 CVE-2026-65711 · GHSA-p3qf-xxxc-f5g8

sysPass 3.2.11 Authenticated OS Command Injection via Backup Path

Priority HIGH 72

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and t…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.0204 Published 2026-07-24 No fix listed CWE-78
TI-2026-46844 CVE-2026-65710 · GHSA-6vgx-33c2-p4gc

sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption

Priority MEDIUM 64

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINK_CREATE profile flag to trigger unauthorized decryption and persistent storage of any vault…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00301 Published 2026-07-24 No fix listed CWE-639
TI-2026-46843 CVE-2026-65709 · GHSA-4m72-xhqc-vmmg

sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API

Priority HIGH 73

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00388 Published 2026-07-24 No fix listed CWE-639
TI-2026-46842 CVE-2026-65708 · GHSA-m6m7-rqhj-c4vv

sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController

Priority HIGH 70

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions f…

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00386 Published 2026-07-24 No fix listed CWE-639