Webmap
Monthly
OS command injection in SabyasachiRana WebMap's nmap_newscan() function permits remote attackers to execute arbitrary shell commands by injecting metacharacters through the unsanitized target and params arguments in the New Nmap Scan Handler (functions_nmap.py). All repository commits up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25 are affected, and the flaw is exploitable without authentication per the CVSS PR:N vector. A public proof-of-concept exploit is available and a silent upstream patch has been committed without a formal security advisory.
OS command injection in SabyasachiRana WebMap's nmap_newscan() function permits remote attackers to execute arbitrary shell commands by injecting metacharacters through the unsanitized target and params arguments in the New Nmap Scan Handler (functions_nmap.py). All repository commits up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25 are affected, and the flaw is exploitable without authentication per the CVSS PR:N vector. A public proof-of-concept exploit is available and a silent upstream patch has been committed without a formal security advisory.