sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

Summary sqlite3-ruby cast Ruby string lengths long to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB 2^32 bytes or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the quer...

GHSA-4FQR-96Q8-XRFX sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

Summary sqlite3-ruby cast Ruby string lengths long to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB 2^32 bytes or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the quer...

CVE-2008-4687-exploit

CVE-2008-4687-exploit Quick and dirty python exploit for CVE-2008-4687. Description by NIST: manageprojpage.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by createfunction within the...

CVE-2026-32304

A flaw was found in Locutus, a JavaScript library that provides standard library functions. The createfunction function in Locutus passes user-supplied arguments and code directly to the JavaScript Function constructor without proper sanitization. This vulnerability allows a remote attacker to...

GHSA-VH9H-29PQ-R5M8 Locutus vulnerable to RCE via unsanitized input in create_function()

Summary The createfunctionargs, code function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 GHSA-fp25-p6mj-qqg6 which was calluserfuncarray using eval in v2.x. This finding affects...

EUVD-2026-11718

Locutus vulnerable to RCE via unsanitized input in createfunction...

CVE-2026-32304: Improper Control of Generation of Code

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the createfunctionargs, code function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from...

CVE-2026-32304

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the createfunctionargs, code function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from...

EUVD-2023-43534

Malicious code in bioql PyPI...

CVE-2023-39834

PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...

CVE-2023-39834

PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...

Command injection

PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...

CVE-2023-39834: Improper Neutralization of Special Elements used in a Command

PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...

PbootCMS command injection vulnerability

PbootCMS is PbootCMS individual developers of an open source enterprise website content management system CMS using PHP language development. PbootCMS v3.2.0 version has a security vulnerability, the vulnerability stems from createfunction has a command injection vulnerability...

CVE-2023-39834

PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...

CVE-2023-39834

PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...

CVE-2021-44529

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance CSA allows an unauthenticated user to execute arbitrary code with limited permissions nobody. Recent assessments: h00die-gr3y at January 08, 2023 9:32am UTC reported: During the boring Christmas Days, — those days where you...

CVE-2008-4687

manageprojpage.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by createfunction within the multisort function in core/utilityapi.php...

Wordpress <= 4.6.1 using the language file arbitrary code execution vulnerability

Author: p0wd3r know Chong Yu 404 security lab 0x00 vulnerability overview 1. Vulnerability description WordPress is a PHP and MySQL as a platform free and open source blogging software and content management system, recently in github...

Code injection

The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP createfunction...