3052 matches found
CVE-2026-34398 FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...
CVE-2026-34398 FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...
CVE-2026-34399 FreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw Page
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable...
CVE-2026-34399 FreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw Page
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable...
CVE-2026-34399
FreeCAD versions 0.19 through 1.1.0 pass SVG template scale-field data through an eval() call in src/Mod/BIM/bimcommands/BimTDPage.py (line 87), allowing arbitrary Python execution when a user creates a TechDraw page from a malicious SVG template. No in-the-wild exploitation is reported. The fix ...
CVE-2026-34399
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable...
CVE-2026-74234
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-74234
Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...
EUVD-2026-60437
Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...
CVE-2026-74234
Legora before 2026-08-14 contains a cross-site scripting (XSS) vulnerability. The root cause is that a Mermaid block prefixed with a gray-matter JavaScript front-matter directive causes the front-matter parser to invoke eval() before any SVG sanitization occurs, enabling arbitrary JavaScript exec...
PT-2026-76764
Name of the Vulnerable Software and Affected Versions Legora versions prior to 2026-08-14 Description A cross-site scripting issue exists where attackers can execute arbitrary JavaScript in a victim's browser. This occurs when a Mermaid block is prefixed with a gray-matter JavaScript front-matter...
PT-2026-76780
Name of the Vulnerable Software and Affected Versions FreeCAD versions 0.19 through 1.1.0 Description The BIM Workbench contains an eval call that processes untrusted data from SVG template files. If a user creates a TechDraw page using a malicious SVG template, arbitrary Python code can be...
PT-2026-76779
Name of the Vulnerable Software and Affected Versions FreeCAD versions 0.19 through 1.1.0 Description In the BIM Project Manager Load Template flow within src/Mod/BIM/bimcommands/BimProjectManager.py, the software passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and...
CVE-2026-73679
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...
CVE-2026-73679 ImpressCMS Authenticated RCE via PHP Custom Tag eval()
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...
EUVD-2026-58789
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...
CVE-2026-73679
ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via...
CVE-2026-73679
ImpressCMS has an authenticated remote code execution vulnerability in the custom tag module. The issue allows authenticated administrators to run arbitrary PHP by storing a payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() and ...