36 matches found
CVE-2026-32304
A flaw was found in Locutus, a JavaScript library that provides standard library functions. The createfunction function in Locutus passes user-supplied arguments and code directly to the JavaScript Function constructor without proper sanitization. This vulnerability allows a remote attacker to...
GHSA-VH9H-29PQ-R5M8 Locutus vulnerable to RCE via unsanitized input in create_function()
Summary The createfunctionargs, code function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 GHSA-fp25-p6mj-qqg6 which was calluserfuncarray using eval in v2.x. This finding affects...
EUVD-2026-11718
Locutus vulnerable to RCE via unsanitized input in createfunction...
EUVD-2023-43534
Malicious code in bioql PyPI...
CVE-2023-39834
PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...
CVE-2023-39834
PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...
Command injection
PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...
CVE-2023-39834
PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...
PbootCMS 命令注入漏洞
PbootCMS is PbootCMS individual developers of an open source enterprise website content management system CMS using PHP language development. PbootCMS v3.2.0 version has a security vulnerability, the vulnerability stems from createfunction has a command injection vulnerability...
CVE-2023-39834
PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via createfunction...
CVE-2021-44529
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance CSA allows an unauthenticated user to execute arbitrary code with limited permissions nobody. Recent assessments: h00die-gr3y at January 08, 2023 9:32am UTC reported: During the boring Christmas Days, — those days where you...
CVE-2008-4687
manageprojpage.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by createfunction within the multisort function in core/utilityapi.php...
Wordpress <= 4.6.1 using the language file arbitrary code execution vulnerability
Author: p0wd3r know Chong Yu 404 security lab 0x00 vulnerability overview 1. Vulnerability description WordPress is a PHP and MySQL as a platform free and open source blogging software and content management system, recently in github...
Code injection
The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP createfunction...
Mantis Bug Tracker <= 1.1.3 - Remote Code Execution Exploit
No description provided by source. ?php / -------------------------------------------------------------------------------- Mantis Bug Tracker = 1.1.3 manageprojpage.php Remote Code Execution Exploit -------------------------------------------------------------------------------- author...: EgiX...
PHP 5.2.6 'create_function()' Code Injection Weakness (2)
No description provided by source. source: http://www.securityfocus.com/bid/31398/info PHP is prone to a code-injection weakness because it fails to sufficiently sanitize input to 'createfunction'. Note that the anonymous function returned need not be called for the supplied code to be executed. ...
PHP 5.2.6 'create_function()' Code Injection Weakness (1)
No description provided by source. source: http://www.securityfocus.com/bid/31398/info PHP is prone to a code-injection weakness because it fails to sufficiently sanitize input to 'createfunction'. Note that the anonymous function returned need not be called for the supplied code to be executed. ...
phpLDAPadmin <= 1.2.1.1 (query_engine) Remote PHP Code Injection
No description provided by source. $Id: phpldapadminqueryengine.rb 14060 2011-10-25 05:25:39Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...
CVE-2014-2558
The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...
Design/Logic Flaw
The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...