A critical vulnerability was found in UpSnap, a wake on lan web app, versions 4.4.1 through 5.3.5. The vulnerability allows an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution. This vulnerability is caused by a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/h [truncated]
A critical vulnerability was found in UpSnap, a wake on lan web app, versions prior to 5.4.0. An authenticated Remote Code Execution (RCE) vulnerability exists due to OS command injection in the device management functionality. User-controlled values can be inserted into shell command templates and executed without sanitization. A low-privileged user with permission to create or edit devices can execute a [truncated]
