Copeland XWEB and XWEB Pro OS Command Injection

An OS command injection

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an

authenticated attacker to achieve remote code execution on the system by

sending malicious input injected into the server username field of the

import preconfiguration action in the API V1 route.