CHIRP-CodeExecution_via_Malicious_ImageFile

CHIRP — Arbitrary Code Execution via eval in Kenwood ITM Driver Product: CHIRP - An open-source project for programming Ham Radios. Affected Versions: URL: https://github.com/kk7ds/chirp, https://chirpmyradio.com Affected Versions: = chirp-next-20260814 CWE: CWE-95 Eval Injection Overview CHIRP's...

cve-2024-36401-geoserver-rce

CVE-2024-36401 — Unauthenticated RCE in GeoServer A complete, reproducible study of CVE-2024-36401 , an unauthenticated remote code execution flaw in GeoServer — the most widely deployed open-source server for geospatial data. The bug is an eval injection : through the parameters of the OGC...

CVE-2025-2945

CVE-2025-2945 - pgAdmin4 Authenticated RCE Exploit Author: G0D150NE Version: 2.0.0 CVE: CVE-2025-2945 Severity: Critical CVSS 9.9 📌 Description Exploit for pgAdmin4 Remote Code Execution RCE vulnerability affecting versions 8.10 to 9.1. The vulnerability exists in the /sqleditor/querytool/downloa...

CVE-2026-78571

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary code execution via an unguarded eval() call in the lfx CodeParser , which passes return-type annotation source directly to eval without sanitization (CWE-94). A remote authenticated attacker can exploit this to execute arb...

CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Ejecución Remota de Código PoC Vulnerabilidad de RCE no autenticada en Fuel CMS 1.4.1. El parámetro filter en el endpoint /fuel/pages/select/ se pasa sin saneamiento a una llamada a eval en el backend de PHP, lo que permite la ejecución arbitraria de código mediant...

CVE-2026-80351

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80351 Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

EUVD-2026-75291

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-80351

Apache Camel K is affected by an eval injection vulnerability (CVE-2026-80351) in its dynamically evaluated Maven configuration. Tenant-controlled repository content can influence code execution within the operator pod , potentially allowing tenants to run arbitrary code with operator-level privi...

CVE-2025-2945-pgAdmin-RCE

CVE-2025-2945 — pgAdmin 4 Authenticated Query Tool RCE CVSS 3.1: 9.9 Critical · Affects: pgAdmin 4 8.10 – 9.1 · Fixed in: 9.2 April 4, 2025 CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code / Eval Injection A proof-of-concept exploit for CVE-2025-2945, an authenticated...

PT-2026-89301

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

CVE-2026-23885

Security Advisory: CVE-2026-23885 Authenticated Remote Code Execution RCE in AlchemyCMS 1. Executive Summary A critical security vulnerability involving Improper Neutralization of Directives in Dynamically Evaluated Code CWE-95 was discovered in the AlchemyCMS framework. The vulnerability allows...

Adobe ColdFusion 2023.x < 2023 Update 24 / 2025.x < 2025 Update 13 Multiple Vulnerabilities (APSB26-119)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 24 or 2025.x update 13. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-119 advisory. - Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval...

CVE-2026-78550

The Okta Access Gateway management console passes user-supplied input to eval without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console...

CVE-2026-76190

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of...

CVE-2026-48273

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code...

CVE-2026-78550 Improper Input Handling in Okta Access Gateway Management Console Exception Handler

The Okta Access Gateway management console passes user-supplied input to eval without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console...

EUVD-2026-74164

The Okta Access Gateway management console passes user-supplied input to eval without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console...

CVE-2026-76190

Adobe ColdFusion is affected by an Eval Injection vulnerability (CWE-95), where improper neutralization of directives in dynamically evaluated code could lead to arbitrary code execution in the context of the current user. The vulnerability is exploitable over the network with low complexity and ...

CVE-2026-76190 ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of...