CVE-2023-43364-Searchor-RCE-Exploit

CVE-2023-43364 – Searchor RCE Exploit PoC Remote Code Execution RCE via unsicherer eval-Nutzung in Searchor 2.4.2 Übersicht Dieses Projekt demonstriert die Ausnutzung von CVE-2023-43364 , einer Remote Code Execution RCE-Schwachstelle, die das Python-Paket Searchor 2.4.2 betrifft. Das Problem wird...

CVE-2023-47253

CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', 개념 증명 POC "gridValoresPopHidden" 매개변수에 PHP 코드를 포함한 URL에 접속하기만 하면 됩니다. 연구자 https://www.linkedin.com/in/xvinicius/...

CVE-2025-0868

Report del Progetto di Penetration Testing: Sfruttamento di CVE-2025-0868 DocsGPT RCE tramite JSON Eval 1. Introduzione Una grave vulnerabilità di Remote Code Execution RCE CVE-2025-0868 è stata divulgata il 20 febbraio 2025 nella libreria open-source DocsGPT, causata dall'uso non sicuro di eval...

CVE-2026-48962

Resumo Uma vulnerabilidade de injeção de eval em File::GlobMapper::getFiles permite que qualquer atacante que consiga controlar o argumento de fileglob de saída passado para IO::Compress::Gzip::gzip, IO::Compress::Zip::zip ou qualquer função similar execute código Perl arbitrário no contexto do...

Reproduce-CVE-2024-21513

Reproduce-CVE-2024-21513 Übersicht Dieses Projekt demonstriert die Sicherheitslücke CVE-2024-21513 im langchain-experimental Paket, speziell in den Versionen =0.0.15 and 0.0.21. Die Schwachstelle ermöglicht die Ausführung von beliebigem Code über die VectorSQLDatabaseChain Komponente beim Abrufen...

CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Execução Remota de Código PoC Vulnerabilidade de RCE não autenticada no Fuel CMS 1.4.1. O parâmetro filter no endpoint /fuel/pages/select/ é passado sem sanitização para uma chamada eval no backend PHP, permitindo execução arbitrária de código por meio de um payloa...

CVE-2025-54322

CVE-2025-54322 - Scanner de RCE Pré-Autenticação XSpeeder SXZOS Um scanner de vulnerabilidade multi-thread para CVE-2025-54322, uma vulnerabilidade de execução remota de código não autenticada no firmware XSpeeder SXZOS afetando 70.000+ hosts globalmente. 📋 Índice Sobre a Vulnerabilidade...

CVE-2023-43364-Exploit-CVE

CVE-2023-43364-Exploit-CVE Dies ist ein Python-Skript zum Ausnutzen von Searchor 2.4.0 - die eval-Funktion wurde unsicher implementiert und kann für RCE ausgenutzt werden. Diese Maschine setzt voraus, dass busybox installiert ist, da ich das Skript für die Busqueda-Maschine auf HackTheBox...

CVE-2023-47253

CVE-2023-47253 CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', Prova di concetto POC Basta accedere all'URL con il tuo codice PHP nel parametro "gridValoresPopHidden"...

CVE-2020-15778

Bericht zur CVE-ID CVE-2020-15778. Entdeckt von: Chinmay Pandya E-Mail-Adresse : [email protected] LinkedIn : www.linkedin.com/in/chinmay-pandya Schwachstellentitel: scp in OpenSSH 8.3p1 ermöglicht eval injection. Produkt: Openssh Betroffene Komponente: SCP...

senaite.core Vulnerable to Eval Injection and Missing Authorization

Summary An unauthenticated remote code execution vulnerability in the SENAITE JSON API allows any network-reachable attacker to execute arbitrary Python on the Zope worker process via a two-request anonymous chain. The /@@API/update route is reachable to anonymous callers and runs eval on...

CVE-2026-54569 SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

EUVD-2026-66596

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in...

CVE-2026-54569

SENAITE.CORE (versions 2.0.0–2.6.0), the core framework for the SENAITE laboratory information management system, permits unauthenticated remote code execution through a two-request chain. State-changing JSON API routes in update.py fail to enforce the senaite.core: Access JSON API permission bef...

CVE-2026-75062

Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt...

CVE-2026-75062

Google langfun versions prior to 0.1.2 are vulnerable to Eval Injection in the default lf.query Python protocol. Crafted prompt inputs can cause the language model to generate executable Python expressions that are evaluated without a sandbox , allowing a remote unauthenticated attacker to execut...

CVE-2026-75062 Eval Injection in google/langfun via default lf.query protocol

Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt...

EUVD-2026-66505

Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt...

proofpoint-CVE-2023-0090

Über Sicherheitsforscher: ly1g3, ly1g3attuta.io GPG-Fingerabdruck: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Übersicht: Remote Code Execution - Nicht authentifizierte RCE CVE: CVE-2023-0090 Zeitplan: Entdeckt - ly1g3 Gemeldet - ly1g3 Behoben -...

cve-2024-36401-geoserver-rce

CVE-2024-36401 — RCE non autenticata in GeoServer Uno studio completo e riproducibile di CVE-2024-36401 , una vulnerabilità di esecuzione remota di codice non autenticata in GeoServer — il server open-source più diffuso per dati geospaziali. Il bug è un'eval injection : tramite i parametri degli...