CVE-2026-60121

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
VITEC	Flamingo	4.12.2

References

https://damiri.fr/en/cve/CVE-2026-60121Third Party Advisory, Exploit
https://www.vitec.com/solutions/iptv-distributionProduct
https://www.vulncheck.com/advisories/vitec-flamingo-unauthenticated-os-command-injection-via-ping-phpThird Party Advisory, Exploit

Timeline

Published: Jul 13, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-601227.8gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker CVE-2026-601245.3An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access CVE-2026-601255.3MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organi CVE-2026-60138.8A vulnerability was detected in D-Link DIR-513 1.10. This vulnerability affects the function formSetRoute of the file /goform/formSetRoute o CVE-2026-601335.8Integer overflow in the MigTD vsock for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of serv CVE-2026-601348.8Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.CVE-2026-601356.5An attacker can modify data that should be restricted to read‑only access.CVE-2026-601375.9WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query CVE-2026-601388.4Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Rin CVE-2026-601396.0Improper neutralization in the MigTD SPDM transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow CVE-2026-60148.8A flaw has been found in D-Link DIR-513 1.10. This issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup of the c CVE-2026-601406.1An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a craf