Vulnerability Database

CVE-2026-55579

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise 27 Jul

CVE-2026-55578

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection 27 Jul

CVE-2026-54540

Authenticated terminal command whitelist bypass in Pheditor 27 Jul

CVE-2026-48030

Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78) 27 Jul

GHSA-f25v-x6vr-962g

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password 24 Jul

GHSA-g3hq-hphg-8fhh

Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes 24 Jul

GHSA-p4h7-p9rj-2pq2

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise 16 Jul

GHSA-wg4w-wr5q-6vjc

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection 16 Jul

GHSA-9643-6xjp-vx57

Pheditor has an authenticated terminal command whitelist bypass 16 Jul

GHSA-jvc5-6g7q-c843

Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter 09 Jun

Vulnerabilities