These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-28517 is a critical OS command injection issue in openDCIM's report_network_map.php. The affected code retrieves the dot configuration value from the database and passes it to exec() without validation or sanitization. If an attacker can change fac_Config.dot, they may execute arbitrary commands in the context of the web server process.
openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication en [truncated]