Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-97r4-rndf-ukdq
Summary
Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability.

The specific flaw exists within the esensors_websensor_configwizard_func method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28249.
Aliases
0
alias CVE-2026-2043
Fixed_packages
Affected_packages
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-2043
reference_id
reference_type
scores
0
value 0.01805
scoring_system epss
scoring_elements 0.83219
published_at 2026-06-11T12:55:00Z
1
value 0.01805
scoring_system epss
scoring_elements 0.83289
published_at 2026-06-13T12:55:00Z
2
value 0.01805
scoring_system epss
scoring_elements 0.8328
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-2043
1
reference_url https://www.nagios.com/changelog/nagios-xi/nagios-xi-2026r1-0-1/
reference_id nagios-xi-2026r1-0-1
reference_type
scores
0
value 7.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-25T04:55:51Z/
url https://www.nagios.com/changelog/nagios-xi/nagios-xi-2026r1-0-1/
2
reference_url https://www.zerodayinitiative.com/advisories/ZDI-26-072/
reference_id ZDI-26-072
reference_type
scores
0
value 7.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-25T04:55:51Z/
url https://www.zerodayinitiative.com/advisories/ZDI-26-072/
Weaknesses
0
cwe_id 78
name Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
description The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Exploits
Severity_range_score7.2 - 7.2
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-97r4-rndf-ukdq