PT-2026-110585

Name of the Vulnerable Software and Affected Versions LogicalDOC Community Edition versions prior to 9.4 Description Authenticated users can execute operating system commands by submitting Velocity templates through the sendAsEmail function in DocumentService. By manipulating the subject or messa...

PT-2026-110539

Name of the Vulnerable Software and Affected Versions Zen Cart versions prior to 2.2.3 Description Code injection is possible via the Administrative Module Management component. The issue exists in the zen call function function within the admin/includes/functions/general.php file. A remote...

CVE-2026-109199: Improper Control of Generation of Code

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing t...

pe_to_shellcode

petoshellcode Convierte un PE para que pueda ser inyectado como un shellcode normal. Al mismo tiempo, el archivo de salida sigue siendo un PE válido. Soporta tanto PEs de 32 como de 64 bits Autores:@hasherezade y @hh86 Objetivo El objetivo de este proyecto es proporcionar la posibilidad de genera...

tplmap

Tplmap Este proyecto ya no recibe mantenimiento. Estaré encantado de fusionar nuevos PRs siempre que no rompan el conjunto de pruebas. Tplmap ayuda en la explotación de vulnerabilidades de Inyección de Código e Inyección de Plantillas del Lado del Servidor SSTI mediante diversas técnicas de escap...

php-jpeg-injector

php-jpeg-injector Inyecta cargas útiles de php en imágenes jpeg. Relacionado con esta publicación. Caso de Uso Tienes una aplicación web que procesa una imagen jpeg a través de la librería gráfica GD de PHP. Descripción Este script inyecta código PHP en una imagen jpeg especificada. La aplicación...

concealed_code_execution

Ejecución de Código Oculto Hunt& Hackett presenta un conjunto de herramientas y documentos técnicos que describen técnicas de ataque que se basan en ocultar la ejecución de código en Windows. Aquí encontrará explicaciones de cómo funcionan estas técnicas, consejos sobre detección y código fuente ...

pyrasite

.. image:: docs/logo.png pyrasite .. image:: https://api.travis-ci.org/lmacken/pyrasite.png?branch=develop :target: http://travis-ci.org/lmacken/pyrasite .. image:: https://coveralls.io/repos/lmacken/pyrasite/badge.png?branch=develop :target: https://coveralls.io/r/lmacken/pyrasite?branch=develop...

process_overwriting

Sobrescritura de Procesos La Sobrescritura de Procesos es una técnica de inyección de PE, estrechamente relacionada con Process Hollowing y Module Overloading. Con su ayuda, puedes reemplazar el ejecutable principal no una DLL del proceso objetivo. Funciona solo para un proceso recién creado: la...

CVE-2026-108598

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

EUVD-2026-96394

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108598

Floci versions 1.1.0 before 2.2.0 are vulnerable to a code injection flaw in the VtlTemplateEngine component. This vulnerability allows unauthenticated attackers to execute OS commands within the Floci JVM by creating a REST API with a MOCK integration . Attackers can leverage unrestricted Veloci...

CVE-2026-108598 Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-103071

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3...

CVE-2026-103071 WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3...

CVE-2026-103071

The VillaTheme Thank You Page Customizer for WooCommerce (woo-thank-you-page-customizer) plugin is vulnerable to an Improper Control of Generation of Code (Code Injection) vulnerability. This issue affects versions through 1.2.3 . An attacker could exploit this flaw to perform Code Injection , po...

EUVD-2026-96379

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3...

CVE-2026-108551

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

EUVD-2026-96346

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...