Flamingo vulnerabilities

2 known vulnerabilities in Flamingo from VITEC. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Flamingo: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-61498Jul 13, 2026VITECEPSS 4.01%

  Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key,

• 9.8 Critical severity

  Flamingo: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-60121Jul 13, 2026VITECEPSS 3.3%

  Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint