42655 matches found
OESA-2026-3765 perl-DBI security update
The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...
Exploit for Code Injection in Gitea
CVE-2026-60004: Gitea Diffpatch API Remote Code Execution...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the CommandArgs static implementation. An attacker can execute arbitrary code by crafting a malicious Groovy Command class that bypasses the Groovy security sandbox. Remediation Upgrade...
CVE-2026-77147
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...
CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...
CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...
CVE-2026-77147
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...
CVE-2026-77147
Apache Syncope is vulnerable to an Improper Control of Generation of Code (Code Injection) vulnerability. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation , effectively ...
EUVD-2026-77457
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...
Astra Linux – Vulnerability in underscore
The package underscore from 1.13.0-0 and before 1.13.0-2, as well as from 1.3.2 and before 1.12.1, are vulnerable to Arbitrary Code Injection via the template function, especially when a variable property is passed as an argument without proper sanitization...
Astra Linux – Vulnerability in Composer
Composer is a dependency manager for the PHP programming language. Integrators who use Composer code to call VcsDriver::getFileContent may encounter a code injection vulnerability if the user can control the $file or $identifier arguments. This vulnerability is documented on packagist.org, where...
Astra Linux – Vulnerability in node-lodash
Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validation for the variable option in .template, but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. When an application passes...
Astra Linux – Vulnerability in Golang-1.19
Templates do not properly handle backticks as JavaScript string delimiters, and do not escape them as expected. Backticks have been used since ES6 for JavaScript template literals. If a template contains a Go template action within a JavaScript template literal, the contents of the action can be...
CVE-2026-90709
A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...
Astra Linux – Vulnerability in libssh
A flaw was discovered in libssh. By using the ProxyCommand or ProxyJump feature, users can exploit unvalidated hostname syntax on the client side. This issue may allow an attacker to inject malicious code into the commands related to these features via the hostname parameter...
CVE-2026-90709 Yot CMS Admin Console admin.php eval code injection
A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...
CVE-2026-90709 Yot CMS Admin Console admin.php eval code injection
A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...
EUVD-2026-77428
A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...
CVE-2026-90709
Yot CMS versions up to 3.3.1 are affected by a code injection vulnerability in the Admin Console component. The root cause is the use of the eval function in modsys/console/admin.php, where manipulation of the text POST argument allows an attacker to inject and execute arbitrary code. The attack ...