Nextor Ip Changer
Approved changes feed: RSS · Atom
cpe:2.3:a:0x5t4l1n:nextor_ip_changer:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | 0X5T4L1N (d65e7c2f-2b7f-516b-a537-971b7f387651) |
|---|---|
| Product | Nextor Ip Changer (d15022ba-a32d-5764-8432-644e81105059) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/0x5t4l1n/nextor_ip_changer |
purl2cpe | 2026-09-09 08:34:08.957092 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-48098 |
vulnerable | 2026-09-16 04:33:05.050511 |
NexTOR IP Changer Unsafely Uses sudo and shell=True
HIGH (7.3)
NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using `sudo` and `shell=True` directly inside application logic. In environments where passwordless sudo (`NOPASSWD`) is enabled, privileged commands may execute silently without explicit user confirmation. Version 2.0.0 fixes the issue.
Published: 2026-08-07T19:09:29.235Z
Updated: 2026-08-07T21:01:58.457Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48097 |
vulnerable | 2026-09-16 04:33:04.741778 |
NexTOR_IP_CHANGER has PATH Injection Leading to Arbitrary Command Execution
HIGH (7.8)
NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of `shell=True` with commands that rely on executable resolution through the `PATH` environment variable. An attacker controlling the execution environment can place malicious executables such as sudo earlier in the `PATH`, resulting in execution of attacker-controlled code. Version 2.0.0 fixes the issue.
Published: 2026-08-07T19:06:22.730Z
Updated: 2026-08-07T19:34:44.269Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.