EUVD-2026-26838

Langflow: Prompt injection in Langflow Smart Transform can lead to code execution...

CVE-2017-9841-PHPUnit-Remote-Code-Execution-PoC

CVE-2017-9841 — PHPUnit 원격 코드 실행RCE PoC ⚠️ 면책 조항: 이 도구는 교육 목적 및 승인된 보안 테스트 전용 으로 제작되었습니다. 소유하지 않았거나 명시적 테스트 권한이 없는 시스템에 대한 무단 사용은 불법 입니다. 작성자는 이 도구의 오용으로 인한 어떠한 책임도 지지 않습니다. 개요 CVE-2017-9841 은 PHPUnit 라이브러리의 5.6.3 미만 및 6.4.2 미만의 6.x 버전에 영향을 미치는 원격 코드 실행RCE 취약점입니다. 이 취약점은 php://inputPOST 본문을 통해 수신된...

CVE-2026-8838-RCE

CVE-2026-8838 — Amazon Redshift Python Driver: eval을 통한 원격 코드 실행 ⚠️ 교육용으로만 사용하세요 오펜시브 사이버보안 연구 및 데모 프로젝트로, 오직 교육 및 인식 제고 목적으로만 수행되었습니다. 명시적 허가 없이 시스템에 사용하는 것은 불법입니다. 이 저장소는 다음에서만 사용해야 합니다: 통제된 실험실, 테스트 환경, CTF 플랫폼, 허가된 학습 환경. 여기에 제시된 취약점 시나리오는 교육적 데모 목적으로만 사용됩니다. 목차 설명 기술 세부사항 공격 벡터 개념 증명 PoC 영향...

CVE-2024-21513

CVE-2024-21513 CVE-2024-21513에 대한 PoC Snyk Security Research에서 문서화한 원본 익스플로잇 Exploit CVE-2024-21513은 langchain-experimental에서 검증되지 않은 SQL 쿼리 결과가 Python의 eval에 전달되어 SQL 기반 입력 주입을 통해 원격 코드 실행이 가능한 취약점입니다. PoC 구조 이 PoC는 사용자가 SQLite DB에 좌표를 입력할 수 있는 인라인 HTML이 포함된 매우 기본적인 Flask 앱입니다. 사용자가 y 값에 악성 페이로드...

CVE-2026-76864

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval in qosxianzaddcgi, qosxianzshowcgi, qosfilteraddcgi, and qosfiltershowcgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is...

EUVD-2026-78820

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-19780 Koha Eval Code Injection Remote Code Execution Vulnerability

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-19780: Improper Neutralization of Directives in Dynamically Evaluated Code

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-90709

Yot CMS versions up to 3.3.1 are affected by a code injection vulnerability in the Admin Console component. The root cause is the use of the eval function in modsys/console/admin.php, where manipulation of the text POST argument allows an attacker to inject and execute arbitrary code. The attack ...

CVE-2026-90709 Yot CMS Admin Console admin.php eval code injection

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

CVE-2026-90709 Yot CMS Admin Console admin.php eval code injection

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

EUVD-2026-77428

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

PT-2026-91171

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the file modsys/console/admin.php of the component Admin Console. Such manipulation of the argument text leads to code injection. It is possible to launch the attack remotely. The...

Koha Eval Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper...

CVE-2026-85040

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-85040 ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-85040 ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

EUVD-2026-70314

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-85040

ZhongBangKeJi CRMEB (up to 6.0.0 ) is vulnerable to OS command injection in the Custom Scheduled Task feature. The eval function in /adminapi/system/crontab/save unsafely processes the customCode argument, allowing remote attackers to inject operating-system commands. The vendor documents this as...

PT-2026-65770

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js to php function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formul...