EUVD-2026-78820

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-90709

Yot CMS versions up to 3.3.1 are affected by a code injection vulnerability in the Admin Console component. The root cause is the use of the eval function in modsys/console/admin.php, where manipulation of the text POST argument allows an attacker to inject and execute arbitrary code. The attack ...

EUVD-2026-77428

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

CVE-2026-90709 Yot CMS Admin Console admin.php eval code injection

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

CVE-2017-9841-PHPUnit-Remote-Code-Execution-PoC

CVE-2017-9841 — PHPUnit リモートコード実行 RCE PoC ⚠️ 免責事項: このツールは教育目的および許可されたセキュリティテストのみ を目的としています。自分が所有していない、または明示的なテスト許可を得ていないシステムに対する不正使用は違法 です。作者はこのツールの誤用に対する一切の責任を負いません。 概要 CVE-2017-9841 は、PHPUnit ライブラリのバージョン 5.6.3 未満 および 6.x 系の 6.4.2 未満 に影響するリモートコード実行 RCE 脆弱性です。 この脆弱性は src/Util/PHP/eval-stdin.php...

CVE-2026-8838-RCE

CVE-2026-8838 — Amazon Redshift Python Driver: eval을 통한 원격 코드 실행 ⚠️ 교육용으로만 사용하세요 오펜시브 사이버보안 연구 및 데모 프로젝트로, 오직 교육 및 인식 제고 목적으로만 수행되었습니다. 명시적 허가 없이 시스템에 사용하는 것은 불법입니다. 이 저장소는 다음에서만 사용해야 합니다: 통제된 실험실, 테스트 환경, CTF 플랫폼, 허가된 학습 환경. 여기에 제시된 취약점 시나리오는 교육적 데모 목적으로만 사용됩니다. 목차 설명 기술 세부사항...

CVE-2024-21513

CVE-2024-21513 CVE-2024-21513 用 PoC Snyk Security Research によって文書化されたオリジナルのエクスプロイト エクスプロイト CVE-2024-21513 は langchain-experimental の脆弱性で、検証されていない SQL クエリの結果が Python の eval に渡され、SQL ベースの入力インジェクションによってリモートコード実行が可能になるというものです。 PoC の構造 この PoC は、ユーザーが SQLite DB に座標を入力できる、インライン HTML を備えた非常に基本的な Flask...

CVE-2026-85040

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-85040 ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

EUVD-2026-70314

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-85040

ZhongBangKeJi CRMEB (up to 6.0.0 ) is vulnerable to OS command injection in the Custom Scheduled Task feature. The eval function in /adminapi/system/crontab/save unsafely processes the customCode argument, allowing remote attackers to inject operating-system commands. The vendor documents this as...

CVE-2026-13353

The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on the AJAX handlers for installaddon,...

PYSEC-2026-1432 Guardrails has an arbitrary code execution vulnerability

An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing i...

PT-2026-55795

Name of the Vulnerable Software and Affected Versions mjperpinosa stumasy versions up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be Description A remote code injection issue exists due to the improper handling of the mathematical sentence argument within the eval function located in the...

CVE-2026-31228

A flaw was found in the Adversarial Robustness Toolbox ART, specifically within its Kubeflow component. The robustness evaluation function for PyTorch models uses the eval function to dynamically evaluate user-supplied strings for the LossFn and Optimizer parameters without proper sanitization. A...

CVE-2025-67486

Dolibarr is an enterprise resource planning ERP and customer relationship management CRM software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is pass...

vps-inventory-monitoring 代码注入漏洞

vps-inventory-monitoring is a web inventory monitoring tool developed by individual developer 546669204. vps-inventory-monitoring has a code injection vulnerability, which stems from the use of the eval function in the VpsTest Console component file app/index/command/VpsTest.php, specifically...

Online Recruitment System for Economic Experiments 安全漏洞

Online Recruitment System for Economic Experiments is an open-source online recruitment system for economic experiments developed by ORSEE. Version 3.1.0 of Online Recruitment System for Economic Experiments contains a security vulnerability. This vulnerability stems from the fact that values...

CVE-2025-67486

Dolibarr is an enterprise resource planning ERP and customer relationship management CRM software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is pass...

CVE-2026-7700

A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file src/lfx/src/lfx/components/llmoperations/lambdafilter.p of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from...