CVE-2026-78844

摘要 javadelight delight-nashorn-sandbox 0.5.5 存在不受控资源消耗漏洞。该沙箱通过向 JavaScript 循环中静态注入中断检查来强制执行 maxCPUTime 限制，但沙箱未能禁用动态代码求值。攻击者可以利用这些函数执行无限循环，从而绕过静态清理器。 漏洞类型： 不受控资源消耗、保护机制失效 产品 https://github.com/javadelight/delight-nashorn-sandbox - 版本 0.5.5 攻击向量 攻击者必须向任何使用 Nashorn 沙箱库进行求值的应用程序提交特制的 JavaScript 载荷。...

Langflow-CVE-2025-3248-Multi-target

⚠️ Langflow RCE 漏洞利用扫描器 CVE-2025-3248 该基于 Python 的扫描器可通过 CVE-2025-3248 自动检测 Langflow 实例中的未认证远程代码执行（RCE）漏洞。它使用一个概念验证（PoC）载荷，滥用 /api/v1/validate/code 端点来执行任意 shell 命令。 🚨 CVE 详情 CVE ：CVE-2025-3248 影响 ：未认证远程代码执行 组件 ：Langflow API /api/v1/validate/code 利用方式 ：通过动态代码执行进行注入 风险 ：严重 🛠 功能特性 🔎 从文件批量扫描多个目标 ⚡️...

CVE-2026-82789

An Eval Injection vulnerability (improper neutralization of directives in dynamically evaluated code) exists in CONPROSYS HMI System (CHS) by CONTEC. A low-privilege attacker who can log in to the product may achieve arbitrary code execution , leading to high impact on confidentiality, integrity,...

PT-2026-91093

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

Vulnerabilities in Adobe ColdFusion

Adobe has identified several vulnerabilities in Adobe ColdFusion. These vulnerabilities include a stored Cross-Site Scripting XSS vulnerability, where an attacker with low privileges can inject malicious scripts into form fields, which are then executed in the user’s browser. There is also a...

Pagekit 安全漏洞

Pagekit is a modular and lightweight CMS Content Management System developed by Pagekit. Versions of Pagekit 1.0.18 and earlier contained security vulnerabilities. These vulnerabilities were caused by an improper handling of directives in the dynamically evaluated code within the function evaluat...

EUVD-2026-21004

A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the function ActionNode.xmlfill of the file metagpt/actions/actionnode.py of the component XML Handler. Executing a manipulation can lead to improper neutralization of directives in dynamically evaluated cod...

CVE-2025-6101 letta-ai letta interface.py function_message eval injection

A vulnerability classified as critical has been found in letta-ai letta up to 0.4.1. Affected is the function functionmessage of the file letta/letta/interface.py. The manipulation of the argument functionname/functionargs leads to improper neutralization of directives in dynamically evaluated...

CVE-2023-35150: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code executio...

CVE-2023-0888

An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device...

zzzphp CMS 1.6.1 Cross Site Request Forgery

Exploit Title: Cross-Site Request ForgeryCSRF of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 26/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version: 1.6.1 Tested on:...

zzzphp CMS 1.6.1 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: Cross-Site Request ForgeryCSRF of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 26/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link:...

zzzphp CMS 1.6.1 - Cross-Site Request Forgery

Exploit Title: Cross-Site Request ForgeryCSRF of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 26/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version: 1.6.1 Tested on:...

zzzphp CMS 1.6.1 - Cross-Site Request Forgery

zzzphp CMS 1.6.1 - Cross-Site Request Forgery Exploit Title: Cross-Site Request ForgeryCSRF of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 26/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip...

zzzphp CMS 1.6.1 - Remote Code Execution

Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 24/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version: 1.6.1 Tested on: windows/Linux,iis/apache C...

ZZZPHP CMS 1.6.1 Remote Code Execution

Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 24/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version: 1.6.1 Tested on: windows/Linux,iis/apache C...

zzzphp CMS 1.6.1 - Remote Code Execution

zzzphp CMS 1.6.1 - Remote Code Execution Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1 Google Dork: intext:"2015-2019 zzcms.com" Date: 24/02/2019 Exploit Author: Yang Chenglong Vendor Homepage: http://www.zzzcms.com/index.html Software Link: http://115.29.55.18/zzzphp.zip Version:...

CVE-2018-7046

Arbitrary code execution vulnerability in Kentico 9 through 11 allows remote authenticated users to execute arbitrary operating system commands in a dynamic .NET code evaluation context via C code in a "Pages - Edit - Template - Edit template properties - Layout" box. NOTE: the vendor has respond...

Debian Security Advisory DSA 1031-1 (cacti)

The remote host is missing an update to cacti announced via advisory DSA 1031-1. Several vulnerabilities have been discovered in libphp-adodb, the 'adodb' database abstraction layer for PHP, which is embedded in cacti, a frontend to rrdtool for monitoring systems and services. The Common...

Debian: Security Advisory (DSA-1029-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...