Travisun Opptrix Schedule API setup command injection
VulDB marked the affected products as already unsupported when this CVE was assigned. A patch may not be available. Review the vendor references for migration or mitigation guidance.
This tag describes support at assignment time, not current support for every related product.
Impact
Travisun Opptrix 0.4.0 has a command injection flaw in the Schedule API setup, allowing remote attack. The project is no longer supported.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Travisun · VulDB
Opptrix
1 range
Travisun · VulDB
Opptrix
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0.4.0
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:travisun:opptrix:*:*:*:*:*:*:*:*Original source description
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-115969View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.