CVE-2026-92257

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in its L7 content management pages, specifically in the call board text and policy group handling components, which use eval() sinks to process input. Attackers with low privileges can inject persistent script...

CVE-2026-76864

Netcore NR255-V version 1.5.130703 suffers from a stored cross-site scripting (XSS) vulnerability in its QoS management interface. QoS rule names are not sanitized before being parsed via eval() in the qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi CGI handlers...

CVE-2026-76864 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval in qosxianzaddcgi, qosxianzshowcgi, qosfilteraddcgi, and qosfiltershowcgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is...

CVE-2026-76858 Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddnswanlistshow.cgi caused by unsafe eval handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed...

CVE-2026-76858

Netcore NR255-V version 1.5.130703 is affected by a stored cross-site scripting (XSS) vulnerability in ddns_wan_list_show.cgi , caused by unsafe use of eval() to process DDNS data. An attacker with access to the DDNS configuration path can inject a malicious script that executes persistently when...

CVE-2026-27384

CVE-2026-27384 CVE-2026-27384 — W3 Total Cache mfunc/eval RCE Scanner Плагин: W3 Total Cache Слаг плагина: w3-total-cache ID CVE: CVE-2026-27384 Оценка CVSS: 9.8 Критический Вектор CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Тип уязвимости: Неавторизованное произвольное выполнение кода...

CVE-2024-21513

CVE-2024-21513 PoC pour CVE-2024-21513 Exploit original documenté par Snyk Security Research Exploit CVE-2024-21513 est une vulnérabilité dans langchain-experimental où des résultats de requêtes SQL non validés sont passés à eval de Python, permettant une exécution de code à distance via une...

CVE-2026-61667

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

EUVD-2026-78896

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

CVE-2026-61667

DIRAC , a distributed computing framework, is vulnerable to remote code execution in the FileCatalog DatasetManager component. The checkDataset function in FileCatalogHandler.py forwards a caller-controlled datasets value to DatasetManager.py, where datasetName is interpolated into an FC_MetaData...

CVE-2026-61667 DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

CVE-2026-45579 DIRAC: RCE in RequestManager due to eval on untrusted input

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py exportgetRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to...

CVE-2026-19780

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

EUVD-2026-78820

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-19780

CVE-2026-19780 is a remote code execution vulnerability in Koha , a web service listening on TCP port 8081 by default. The flaw stems from improper validation of a user-supplied string before it is passed to the eval function, allowing an authenticated remote attacker to execute arbitrary code in...

CVE-2023-43364-Searchor-RCE-Exploit

CVE-2023-43364 – Exploit RCE de Searchor PoC Exécution de code à distance RCE via l'utilisation non sécurisée de eval dans Searchor 2.4.2 Aperçu Ce projet démontre l'exploitation de CVE-2023-43364 , une vulnérabilité d'exécution de code à distance RCE affectant le package Python Searchor 2.4.2. L...

CVE-2026-48962

Краткое описание Уязвимость внедрения eval в File::GlobMapper::getFiles позволяет любому атакующему, контролирующему аргумент выходного файлового шаблона, переданного в IO::Compress::Gzip::gzip, IO::Compress::Zip::zip или любую аналогичную функцию, выполнить произвольный Perl-код в контексте...

proofpoint-CVE-2023-0090

À propos Chercheur en sécurité : ly1g3, ly1g3attuta.io Empreinte GPG : https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Aperçu : Exécution de code à distance - RCE non authentifiée CVE : CVE-2023-0090 Chronologie : Découvert - ly1g3 Signalé - ly1g3 Corrigé -...

CVE-2023-43364-Exploit-CVE

CVE-2023-43364-Exploit-CVE Il s'agit d'un script Python pour exploiter Searchor 2.4.0 – la fonction eval a été implémentée de manière non sécurisée et peut être exploitée pour exécuter du code à distance RCE. Cette machine repose sur l'installation de busybox, car j'ai écrit ce script pour la...

CVE-2017-9841

phpunit-shell ⭐ простой скрипт на python3 для эксплуатации CVE-2017-9841. эксплуатация - CVE-2017-9841 ❗ Простой скрипт, эксплуатирующий уязвимость удаленного выполнения кода, найденную в PHPUnit до версии 4.8.28 и 5.x до версии 5.6.3. Отправляет POST-запрос к цели с системными командами,...