CVE-2026-79784

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...

CVE-2026-79784 Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...

CVE-2026-79784

Vocos (through 0.1.0 ), a Python library maintained by gemelo-ai, suffers from arbitrary code execution via an unrestricted class_path field in its model configuration. The vulnerable function instantiate_class in vocos/pretrained.py uses __import__ and getattr on a user-supplied dotted path with...

CVE-2026-79784 Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...

CVE-2026-79784 Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiateclass in vocos/pretrained.py takes the classpath value from the configuration, splits it into a module and an attribute, imports the module with import, resolves the attribute with...

EUVD-2006-3748

Malware in sbrugna...

CVE-2010-4943: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to execute arbitrary PHP code via a URL in the classpath parameter to 1 file.php or 2 comdel.php...

Saurus CMS 4.6.4 - Multiple Remote File Inclusions

Exploit Title: SaurusCMS = 4.6.4 Multiple RFI Exploit Date: 19-12-2009 Author: cr4wl3r Software Link: http://www.saurus.info Version: N/A Tested on: GNU/LINUX Code class.writeexcelworkbook.inc.php global $classpath; requireonce $classpath."excel/class.writeexcelbiffwriter.inc.php"; requireonce...

CVE-2007-1415: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in PMB Services 3.0.13 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the 1 classpath parameter to a includes/resafunc.inc.php b admin/notices/perso.inc.php, or c admin/quotas/main.inc.php; the 2 basepath parameter ...

CVE-2006-3754

CVE-2006-3754 is a PHP remote file inclusion vulnerability in FlushCMS 1.0.0-pre2 and earlier. The flaw resides in Include/editor/rich_files/class.rich.php, where an attacker can cause remote PHP code execution by supplying a URL in the class_path parameter. The connected documents confirm the af...

CVE-2006-3754: Undefined Security Weakness

PHP remote file inclusion vulnerability in Include/editor/richfiles/class.rich.php in FlushCMS 1.0.0-pre2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the classpath parameter...

CVE-2006-3755: Undefined Security Weakness

PHP remote file inclusion vulnerability in Include/editor/class.rich.php in FlushCMS 1.0.0-pre2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the classpath parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party...

CVE-2006-2819: Undefined Security Weakness

PHP remote file inclusion vulnerability in Wiki.php in Barnraiser Igloo 0.1.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the cnodeclasspath parameter...

CVE-2006-2730

PHP remote file inclusion vulnerability in admin/libactionstep.php in Hot Open Tickets HOT 11012004ver2f, when registerglobals is enabled, allows remote attackers to include arbitrary files via the GLOBALSCLASSPATH parameter. NOTE: this issue might be resultant from a global overwrite vulnerabili...

CVE-2006-2730: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/libactionstep.php in Hot Open Tickets HOT 11012004ver2f, when registerglobals is enabled, allows remote attackers to include arbitrary files via the GLOBALSCLASSPATH parameter. NOTE: this issue might be resultant from a global overwrite vulnerabili...

Hot Open Tickets <= 11012004 (CLASS_PATH) Remote Include Vuln

Exploit for unknown platform in category web applications ============================================================= Hot Open Tickets = 11012004 CLASSPATH Remote Include Vuln ============================================================= DEVIL TEAM THE BEST POLISH TEAM HOT Hot Open Tickets...