CVE-2026-10872

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.

• CWE-77
• CWE-78

• https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/03-start_vpnserver.md
• https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/03-start_vpnserver.md
• https://vuldb.com/cve/CVE-2026-10872
• https://vuldb.com/submit/831858
• https://vuldb.com/vuln/368362
• https://vuldb.com/vuln/368362/cti

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10864A vulnerability in the MISP dashboard widgets allowed an aut…4.3
• CVE-2026-10865The Cost Calculator Builder plugin for WordPress is vulnerab…5.3
• CVE-2026-10868A mass assignment vulnerability exists in the MISP user edit…9
• CVE-2026-1087The Guardian News Feed plugin for WordPress is vulnerable to…4.3
• CVE-2026-10870A flaw has been found in Shibby Tomato 1.28.0000. This affec…7.3
• CVE-2026-10871A vulnerability has been found in Shibby Tomato 1.28.0000. T…7.3
• CVE-2026-10873A vulnerability was determined in Shibby Tomato 1.28.0000. I…7.3
• CVE-2026-10874A vulnerability was identified in projectworlds Online Art G…6.3
• CVE-2026-10875A security flaw has been discovered in projectworlds Online …6.3
• CVE-2026-10876A weakness has been identified in SourceCodester Ship Ferry …6.3
• CVE-2026-10877A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-10878A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.7…8.8