Product
XWEB EVO versions 5.6.2 through 5.8.8 are vulnerable to authenticated OS command injection in api.lua, enabling arbitrary command execution with root privileges.