Pheditor (<= 2.0.6)

A vulnerability in Pheditor's terminal feature (versions <= 2.0.6) allows authenticated attackers to achieve arbitrary command execution via argument injection into allowlisted binaries, which can be chained with default credentials for effective unauthenticated remote code execution on the underlying host.