Olivetin CVE-2025-50946

OS command injection in OliveTin web shell interface through version 3000.10.0. OliveTin provides web-based access to pr

OliveTin gives access to predefined shell commands from a web interface. [CVSS 8.8 HIGH]

Arbitrary file write in OliveTin prior to 3000.11.2 allows authenticated attackers to write files to arbitrary filesyste

Memory-exhaustion denial of service in OliveTin (versions 3000.0.0 through 3000.16.x) allows a remote unauthenticated at

OliveTin versions prior to 3000.10.2 are vulnerable to unauthenticated denial of service through the PasswordHash API en

OliveTin versions prior to 3000.10.3 are vulnerable to unauthenticated denial-of-service attacks when OAuth2 authenticat

OliveTin versions prior to 3000.11.0 suffer from broken access control allowing unauthenticated users to invoke the Kill

OS command injection in OliveTin versions 3000.2.0 through 3000.16.x allows an authenticated user to execute arbitrary s

OliveTin prior to version 3000.11.1 fails to enforce view permission checks on dashboard and API endpoints, allowing aut

OliveTin prior to version 3000.11.1 fails to invalidate server-side sessions upon user logout, allowing attackers with a

OliveTin versions prior to 3000.11.1 contain an authentication bypass in RestartAction that allows authenticated users t

Concurrent action execution in OliveTin versions 3000.0.0 and prior triggers a race condition in a shared text/template.