3590 matches found
EUVD-2026-87489
OpenClaw npm package 'openclaw' versions = 2026.3.22 and 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign...
CVE-2026-100561 OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
OpenClaw npm package 'openclaw' versions = 2026.3.22 and 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign...
CVE-2026-100561 OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
OpenClaw npm package 'openclaw' versions = 2026.3.22 and 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign...
CVE-2026-100561
The OpenClaw (npm package 'openclaw' ) versions >= 2026.3.22 and
CVE-2026-100559 OpenClaw before 2026.8.1 Command Injection via Escaped Newlines
OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected...
CVE-2026-100530
Versions of OpenClaw before 2026.8.1 are vulnerable to an issue where the software fails to bind the working directory context to reusable exec approvals . This oversight allows approved commands to execute in different directories than originally intended. An attacker possessing an allow-always ...
EUVD-2026-87520
OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materiall...
CVE-2026-100530 OpenClaw before 2026.8.1 Exec Approval Directory Binding
OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materiall...
CVE-2026-100530 OpenClaw before 2026.8.1 Exec Approval Directory Binding
OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materiall...
CVE-2026-96795
Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...
CVE-2025-3248
CVE-2025-3248 Introducción Las versiones de Langflow anteriores a la 1.3.0 son susceptibles a una inyección de código no autenticada en el endpoint /api/v1/validate/code a través de la función Python exec. Este exploit establece una conexión de shell inversa abusando de esta vulnerabilidad. Uso...
CVE-2026-96795 Horilla: Authenticated RCE in Horilla List-View Export
Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...
CVE-2026-96795 Horilla: Authenticated RCE in Horilla List-View Export
Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...
CVE-2025-58098
CVE-2025-58098 directiva exec cmd=... CVE-2025-58098 inyección de argumentos Laboratorio docker build -t cve-2025-58098-lab . docker run -it -p 8080:80 cve-2025-58098-lab Vulnerable Parcheado...
cve-2025-32433
PoC de RCE ciega no autenticada en SSH de Erlang/OTP CVE-2025-32433 📜 Descripción CVE-2025-32433 es una vulnerabilidad crítica de ejecución remota de código no autenticada en el servidor SSH de Erlang/OTP. Antes de las versiones parcheadas, el demonio SSH procesa incorrectamente los mensajes de...
Sitecore Experience Platform Pre-Auth RCE
Sitecore XP 7.5 to Sitecore XP 8.2 Update 7 is vulnerable to an insecure deserialization attack where remote commands can be executed by an attacker with no authentication or special configuration required. id: CVE-2021-42237 info: name: Sitecore Experience Platform Pre-Auth RCE author: pdteam...
mongo-express Remote Code Execution
mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the toBSON method and misuse the vm dependency to perform exec commands in a non-safe environment. id: CVE-2019-10758 info: name: mongo-express Remote Code Execution author: princechaddha severity: critical...
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060...
CVE-2018-7600
CVE-2018-7600 / SA-CORE-2018-002 的概念验证 codebeat badge 在 Drupal 7.58 之前版本、8.x 版本 8.3.9 之前、8.4.x 版本 8.4.6 之前以及 8.5.x 版本 8.5.1 之前，远程攻击者可以通过影响多个子系统（使用默认或常用模块配置）的问题执行任意代码。 工作原理 1. 向 drupalajax 封装发送数据包以注册用户。允许用户使用 exec 标记并运行 bash。此 PoC 将用户名和 ID 发送至 abcde.txt。 echo Name: $id -un UID: $id -u Groups: $id...