PT-2026-93720

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242EIMS version V1.06.01 Description An improper control of code generation issue exists in the Modbus CSV import workflow. This allows a remote authenticated attacker to execute arbitrary Lua code on the device by using a...

CVE-2026-11841: Files or Directories Accessible to External Parties

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access witho...

Design/Logic Flaw

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...

CVE-2023-52252: Improper Restriction of XML External Entity Reference

Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint...

Design/Logic Flaw

The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows 1 remote attackers to execute arbitrary Lua code via a RunLua action in a request to upnp/control/hag on port 49451 or 2 remote authenticated users to execute arbitrary Lua code via a RunLua action in a request...

PT-2020-7513

Name of the Vulnerable Software and Affected Versions: MiCasaVerde VeraLite version 1.5.408 Description: The issue allows remote attackers to execute arbitrary Lua code via a RunLua action in a request to "upnp/control/hag" on port 49451. Additionally, remote authenticated users can execute...

CVE-2013-4863: Improper Authentication

The HomeAutomationGateway service in MiCasaVerde VeraLite with firmware 1.5.408 allows 1 remote attackers to execute arbitrary Lua code via a RunLua action in a request to upnp/control/hag on port 49451 or 2 remote authenticated users to execute arbitrary Lua code via a RunLua action in a request...

CVE-2018-8073

Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension...

CVE-2018-8073

Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension...

Redis EVAL Lua Sandbox Security Bypass Vulnerability

Redis is an open source memory-based and key-value pair storage the simplest form of database organization database system. Redis has a security vulnerability that allows a remote attacker to bypass certain security restrictions by submitting a special eval command to execute arbitrary Lua byteco...