majordomo-CVE-2026-27174-poc

majordomo-CVE-2026-27174-poc Proof-of-concept, эксплуатирующий удалённое выполнение кода без аутентификации через PHP-консоль панели администратора в MajorDomo Major Domestic Module. Уязвимость Панель администратора MajorDoMo предоставляет доступ к консоли оценки PHP через /admin.php. Из-за...

CVE-2026-90709

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

Astra Linux – Vulnerability in libmodule-scandeps-perl

Qualys discovered that if unsanitized input was used with the Modules::ScanDeps library, before version 1.36, a local attacker could potentially execute arbitrary shell commands by opening a “pesky pipe” e.g., passing “commands|” as a filename or by passing arbitrary strings to the eval function...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first gain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw resides within...

Astra Linux – Vulnerability in libio-compress-perl

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. The parseOutputGlob function wraps the output glob string provided by the caller within double quotes and stores it in the parser state. Then, the getFiles function...

CVE-2026-90709

Yot CMS versions up to 3.3.1 are affected by a code injection vulnerability in the Admin Console component. The root cause is the use of the eval function in modsys/console/admin.php, where manipulation of the text POST argument allows an attacker to inject and execute arbitrary code. The attack ...

EUVD-2026-77428

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

CVE-2026-90709 Yot CMS Admin Console admin.php eval code injection

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789

An Eval Injection vulnerability (improper neutralization of directives in dynamically evaluated code) exists in CONPROSYS HMI System (CHS) by CONTEC. A low-privilege attacker who can log in to the product may achieve arbitrary code execution , leading to high impact on confidentiality, integrity,...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

EUVD-2026-77243

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2025-54322-exploit

CVE-2025-54322: Pre-Auth RCE-эксплойт для XSpeeder SXZOS Профессиональный Proof-of-Concept PoC эксплойт для CVE-2025-54322 — критической уязвимости удалённого выполнения кода до аутентификации в прошивке XSpeeder SXZOS. Эта уязвимость была обнаружена и раскрыта автономным AI-агентом из pwn.ai. 🔍...

sk-cve-2026-26030-lab

CVE-2026-26030 — Filtre eval RCE dans Semantic Kernel lab Un laboratoire autonome reproduisant CVE-2026-26030 : exécution de code à distance RCE injectable par prompt via le filtre de recherche du magasin vectoriel en mémoire dans Microsoft Semantic Kernel Python, Lab éthique uniquement. Isolé da...

safe-expr-eval

safe-expr-eval Évaluateur d'expressions rapide et léger pour JavaScript et TypeScript. Un analyseur d'expressions moderne avec une API familière, zéro dépendance et un support complet de TypeScript. Fonctionnalités Analyse et évaluation rapides des expressions Léger et sans dépendance Support...

PHPUnit_eval-stdin_RCE

PHPUniteval-stdinRCE CVE-2017-9841 PHPUniteval-stdinphp Exécution de code à distance Une vulnérabilité d'injection de code dans PHPUnit, un framework de test unitaire PHP qui fait partie des modules Mailchimp et Mailchimp E-Commerce dans Drupal. La vulnérabilité se situe dans le fichier...

Interpreter-HackTheBox

Interpreter — HackTheBox Платформа: HackTheBox ОС: Linux Статус: Retired — полный walkthrough опубликован. Полный walkthrough: l3dsec.com/walkthroughs/interpreter-htb Цепочка атаки root@kitploit: Nmap → Mirth Connect 4.4.0 80/443 → CVE-2023-43208 неаутентифицированный RCE через Java-десериализаци...

CVE-2025-50881

CVE-2025-50881 : Exécution de code à distance dans API Use it Flow via moniteur.php Identifiant: CVE-2025-50881 Produit concerné : API Use it Flow Version 8.2.0 Rev 15851, Version 9.2.0 Rev 18093 Éditeur : https://www.tenorsolutions.com anciennement https://api-sas.fr/ Composants concernés :...

CVE-2025-2945-pgadmin-rce

CVE-2025-2945 — RCE authentifié via l'outil de requête pgAdmin 4 Preuve de concept pour CVE-2025-2945, une vulnérabilité critique d'exécution de code à distance dans pgAdmin 4. Versions affectées : 8.10 à 9.1 Corrigé dans : 9.2 publié le 4 avril 2025 CVSS v3.1 : 9.9 Critique Aperçu L'outil de...

atlas-tj-actions-poc

CVE-2025-54416: tj-actions/branch-names Preuve de concept d'injection de commandes Ce dépôt démontre CVE-2025-54416 , une vulnérabilité critique d'injection de commandes dans tj-actions/branch-names affectant plus de 5 000 dépôts publics. Vulnérabilité L'action GitHub tj-actions/branch-names...