CVE-2026-51917

FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modifycode...

CVE-2026-51911

vanna v2.0.2 contains a code injection vulnerability in VannaBase.getplotlyfigure src/vanna/legacy/base/base.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-51898

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...

CVE-2025-3248-Langflow-RCE

CVE-2025-3248 — Langflow の未認証リモートコード実行 CVE-2025-3248 の概念実証エクスプロイトです。これは、AI/LLMワークフロー構築プラットフォームである Langflow における未認証のリモートコード実行の脆弱性です。 影響を受けるバージョン: Langflow 1.3.0 修正バージョン: 1.3.0 脆弱性クラス: 未認証RCE（CWE-94、コードインジェクション） ステータス: ボットネットによる実環境での悪用が確認された後、CISAの既知の悪用された脆弱性カタログ に追加されました。 根本原因 Langflow は、UI から送信され...

CVE-2026-9198

🚨 CVE-2026-9198 IBM Langflow OSS 자동 로그인 우회를 통한 무인증 RCE 📋 개요 CVE-2026-9198 는 IBM Langflow OSS에서 발생하는 치명적인 무인증 원격 코드 실행RCE 취약점입니다. 이 익스플로잇은 두 가지 취약점을 연쇄적으로 이용합니다: CVE-2026-9103 : 무인증 호출자에게 슈퍼유저 JWT 토큰을 부여하는 자동 로그인 우회 CVE-2026-8481 : 임의 Python 코드 실행을 허용하는 /api/v1/validate/code 엔드포인트의 코드 인젝션 ⚠️ 경고 : 이...

CVE-2026-10026

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...

DS-Wireless-Communication-Remote-Code-Execution

DS 무선 통신 원격 코드 실행 클라이언트의 게임에 임의의 코드를 주입합니다. 사전 요구 사항 Python 3.10 pip pydivert 사용법 pip install -r requirements.txt python dswirelesscommunicationremotecodeexecution.py CVE-ID CVE-2023-45887 라이선스 GNU General Public License v2.0...

Debinject

Debinject .deb에 악성 코드를 주입합니다 유지보수자 Alisson Moretto | 트위터: @UndeadSec 깃허브: @UndeadSec 비디오 데모 복제 git clone https://github.com/UndeadSec/Debinject.git 실행 cd Debinject python debinject.py 사전 요구 사항 python 2.x dpkg dpkg-deb metasploit 면책 조항 교육 목적으로만 사용해야 합니다. Debinject의 사용은 전적으로 최종 사용자의 책임입니다. 개발자는 이...

CVE-2026-70553-PoC

CVE-2026-70553 - MaxSite CMS 認証なしRCE CVE-2026-70553のProof-of-Concept: インストールエンドポイントを介してdatabase.phpに持続的なPHPコードインジェクションを行う、MaxSite CMSにおける認証なしリモートコード実行。 免責事項 このPoCは教育および許可されたセキュリティ研究目的のみ を意図しています。著者は、このコードによって引き起こされる誤用や損害について一切責任を負いません。所有するシステム、または明示的な書面による許可を得たシステムに対してのみテストしてください。 脆弱性の概要 MaxSite...

CVE-2026-10026

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to and including 7.6.12 . The root cause is insufficient input validation on the 'Feed Config' field, which is passed directly to the eval() function. This allows authenticated attackers with Administrator-le...

EUVD-2026-91171

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...

CVE-2026-10026 CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...

ShimMe

ShimMe DEFCON 32 トーク “SHIM me what you got - Manipulating Shim and Office for Code Injection” のツール群 Office Injector - OfficeClickToRun サービスの RPC メソッドを呼び出して、タスク スケジューラ サービスが起動した、NT AUTHORITY\SYSTEM として実行中の一時停止プロセスに DLL を注入し、管理者から SYSTEM への権限昇格を実現します。 Shim Injector - 非公開の shim...

EUVD-2026-91124

deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment...

EUVD-2026-91120

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

EUVD-2026-91756

FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modifycode...

PT-2026-104075

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval function. This makes it possible for authenticated attackers, with...

CVE-2026-51922

The agentscope v1.0.20 library is vulnerable to a code injection flaw within the execute_shell_command function located in src/agentscope/tool/_coding/_shell.py. Depending on the exposed entry point, an attacker can trigger attacker-controlled code or command execution . Exploitation details and ...

CVE-2026-51917

FinRobot v1.0.0 is vulnerable to a Code Injection flaw within the CodingUtils.modify_code function. The provided documents do not specify the underlying root cause, practical consequences, or a remediation path. No exploit information is available.

EUVD-2026-91754

agentscope v1.0.20 contains code injection in executeshellcommand src/agentscope/tool/coding/shell.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...