4243 matches found
CVE-2025-48868
Horilla is a free and open source Human Resource Management System HRMS. An authenticated Remote Code Execution RCE vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval function on a user-controlled query parameter in the projectbulkarchive view. This allows privileged use...
CVE-2025-48868 Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive
Horilla is a free and open source Human Resource Management System HRMS. An authenticated Remote Code Execution RCE vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval function on a user-controlled query parameter in the projectbulkarchive view. This allows privileged use...
CVE-2025-48868 Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive
Horilla is a free and open source Human Resource Management System HRMS. An authenticated Remote Code Execution RCE vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval function on a user-controlled query parameter in the projectbulkarchive view. This allows privileged use...
PT-2025-39264
Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.3.1 Description Horilla is a free and open source Human Resource Management System HRMS. An authenticated Remote Code Execution RCE issue exists due to the unsafe use of Python’s eval function on a user-controlled...
CVE-2025-48868: Improper Neutralization of Directives in Dynamically Evaluated Code
Horilla is a free and open source Human Resource Management System HRMS. An authenticated Remote Code Execution RCE vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval function on a user-controlled query parameter in the projectbulkarchive view. This allows privileged use...
10minions-engine (>=0.0.1, <=0.0.4), 3ui (>=0.1.0, <=0.1.8) +2037 more potentially affected by CVE-2025-13204 via expr-eval (>=0.12.0, <=2.0.2)
expr-eval NPM version =0.12.0, =0.0.1, =0.1.0, =1.0.2, =1.2.0, =1.0.0, =0.1.4, =0.0.1, =0.4.2, =0.4.4 - @activepieces/piece-aianswer 0.1.5 and more Source cves: CVE-2025-13204 Source advisory: SNYK:JS-EXPREVAL-13508636...
antgrid-server (>=0.0.2, <=0.0.3), nemo-aligner (>=0.1.0, <=0.6.0) +2 more potentially affected by CVE-2025-23316 via nvidia-pytriton (0.7.0)
nvidia-pytriton PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-pytriton and may be impacted: - antgrid-server =0.0.2, =0.1.0, =0.1.0rc1, =0.1.0, =0.7.1 Source cves: CVE-2025-23316 Source advisory:...
antgrid-server (>=0.0.2, <=0.0.3), nemo-aligner (>=0.1.0, <=0.6.0) +2 more potentially affected by CVE-2025-23336 via nvidia-pytriton (0.7.0)
nvidia-pytriton PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-pytriton and may be impacted: - antgrid-server =0.0.2, =0.1.0, =0.1.0rc1, =0.1.0, =0.7.1 Source cves: CVE-2025-23336 Source advisory:...
antgrid-server (>=0.0.2, <=0.0.3), nemo-aligner (>=0.1.0, <=0.6.0) +2 more potentially affected by CVE-2025-23328 via nvidia-pytriton (0.7.0)
nvidia-pytriton PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-pytriton and may be impacted: - antgrid-server =0.0.2, =0.1.0, =0.1.0rc1, =0.1.0, =0.7.1 Source cves: CVE-2025-23328 Source advisory:...
antgrid-server (>=0.0.2, <=0.0.3), nemo-aligner (>=0.1.0, <=0.6.0) +2 more potentially affected by CVE-2025-23329 via nvidia-pytriton (0.7.0)
nvidia-pytriton PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-pytriton and may be impacted: - antgrid-server =0.0.2, =0.1.0, =0.1.0rc1, =0.1.0, =0.7.1 Source cves: CVE-2025-23329 Source advisory:...
The vulnerability of the eval() function in Totolink A3002R router microprogramming software allows a hacker to perform cross-site scripting attacks.
The vulnerability of the eval function in Totolink A3002R router microprogramming software relates to the failure to eliminate instructions from the dynamically executed code. Exploiting this vulnerability could allow a remote attacker to perform domain--site attacks...
disable_eval
This is a Ruby gem called "disableeval" that provides a method to protect against eval-related security vulnerabilities. The gem is designed to prevent remote code execution RCE attacks by disabling the eval method and its variants. The gem provides two main components: 1. A Rack middleware that...
CVE-2025-8417
The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token e.g. ?key= 900001705 without proper authentication, combined with the unsafe use of eval on...
CVE-2025-8417
The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token e.g. ?key= 900001705 without proper authentication, combined with the unsafe use of eval on...
CVE-2025-8417 Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection
The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token e.g. ?key= 900001705 without proper authentication, combined with the unsafe use of eval on...
CVE-2025-8417
CVE-2025-8417 affects the WordPress plugin Catalog Importer, Scraper & Crawler (versions
CVE-2025-8417: Improper Control of Generation of Code
The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token e.g. ?key= 900001705 without proper authentication, combined with the unsafe use of eval on...
PT-2025-37127
Name of the Vulnerable Software and Affected Versions: Catalog Importer, Scraper & Crawler plugin for WordPress versions through 5.1.4 Description: The Catalog Importer, Scraper & Crawler plugin for WordPress is susceptible to PHP code injection due to reliance on a guessable numeric token e.g.,...
WordPress plugin Catalog Importer Scraper Crawler 代码注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in...
