Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-supplied values directly to shell commands via passthru(), to execute arbitrary OS commands with root privileges due to the web server context having passwordless sudo access.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-13 | 5 | Disclosure5 |
| 2026-07-15 | 1 | Patch1 |
🚨 CVE-2026-61498 — CVSS 9.8/10 ██████████ Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/21JJFVjBjk
Post summary
A critical unauthenticated OS command injection has been disclosed for Vitec Flamingo 4.12.2, with a patch available and CVSS 9.8/10.
🚨 CRITICAL: CVE-2026-61498 (CVSS 9.8) - Vitec Flamingo 4.12.2 unauthenticated OS command injection. Remote attackers can execute arbitrary commands with root privileges via admin/ajax/gen_graphs[.]php. Patch immediately! #CVE #PatchNow #ThreatIntel https://t.co/tJgtSgUHns
Post summary
The tweet alerts about a critical unauthenticated OS command injection in Vitec Flamingo 4.12.2, stressing that a patch is available and should be applied immediately.
CVE-2026-61498 Unauthenticated OS Command Injection in Vitec Flamingo 4.12.2 Admin Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-61498
Post summary
The post announces the discovery of an unauthenticated OS Command Injection vulnerability (CVE‑2026‑61498) affecting the Vitec Flamingo 4.12.2 admin endpoint, with technical details but no evidence of active exploitation or mitigations.
🚨*CVE* CVE-2026-61498 Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated atta… https://www.cve.org/CVERecord?id=CVE-2026-61498 ----- Traducción: CVE-2026-61498 Vit… http://infoflow.cloud`
Post summary
An unauthenticated OS command injection vulnerability has been disclosed for Vitec Flamingo 4.12.2, affecting the admin/ajax/gen_graphs.php endpoint, but no exploitation or patch details are provided.
CVE-2026-61498 Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated atta… https://www.cve.org/CVERecord?id=CVE-2026-61498
Post summary
The entry announces a new vulnerability—an unauthenticated OS command injection in Vitec Flamingo 4.12.2's gen_graphs.php endpoint—with a link to the CVE record.
🔒 #CyberSecurity CVE-2026-61498: Critical Sudo Vulnerability — Remote RCE Detection and Hardening "The security landscape has shifted dramatically with the disclosure of CVE-2026-61498, a…" 🔗 https://securityarsenal.com/blog/cve-2026-61498-critical-sudo-vulnerability-remote-rce-detection-and-hardening #CyberSecurity #ThreatIntel #cve202661498 #critical #cve
Post summary
The tweet announces the disclosure of CVE-2026-61498 and links to a blog post about the critical sudo vulnerability, but offers no additional technical or exploit details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vitec | flamingo | - | - | - |