Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
HummerRisk 1.5.0 Allows Untrusted Input to Run Commands on Server
CVE-2026-3065
Summary
A weakness in HummerRisk 1.5.0 allows an attacker to insert malicious commands into the system, potentially allowing them to execute unauthorized actions. This could happen if a malicious user provides specially crafted input. To protect your system, update HummerRisk to a version more recent than 1.5.0, as soon as possible.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| hummerrisk | hummerrisk | <= 1.5.0 | – |
Original title
A vulnerability was detected in HummerRisk up to 1.5.0. This affects the function CommandUtils.commonExecCmdWithResult of the file CloudTaskService.java of the component Cloud Task Dry-run. Perform...
Original description
A vulnerability was detected in HummerRisk up to 1.5.0. This affects the function CommandUtils.commonExecCmdWithResult of the file CloudTaskService.java of the component Cloud Task Dry-run. Performing a manipulation of the argument fileName results in command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
nvd CVSS2.0
6.5
nvd CVSS3.1
8.8
nvd CVSS4.0
5.3
Vulnerability type
CWE-74
Injection
CWE-77
Command Injection
- https://github.com/AnalogyC0de/public_exp/issues/9 Exploit Issue Tracking Mitigation Third Party Advisory
- https://vuldb.com/?ctiid.347416 Permissions Required VDB Entry
- https://vuldb.com/?id.347416 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.757696 Third Party Advisory VDB Entry
Published: 24 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026