CVE-2025-50881

CVE-2025-50881: Remote Code Execution in API Use it Flow via moniteur.php Identifier: CVE-2025-50881 Affected Product: API Use it Flow Version 8.2.0 Rev 15851, Version 9.2.0 Rev 18093 Editor: https://www.tenorsolutions.com formerly https://api-sas.fr/ Affected Components: flow/admin/moniteur.php...

CVE-2026-9147-uproot-rce

CVE-2026-9147: uproot Code Injection via TStreamerInfo Metadata Severity: High, CVSS 4.0 8.5 , CVSS 3.1 7.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected: uproot = 5.7....

CVE-2026-44262

dedoc/scramble RCE CVE-2026-44262 PoC 📜 Description CVE-2026-44262 is an unauthenticated Remote Code Execution vulnerability in dedoc/scramble, a Laravel API documentation generator. NodeRulesEvaluator::doEvaluateExpression calls extract$variables before eval"return $code;". When a controller...

CVE-2026-47103-python-statemachine-rce

CVE-2026-47103: Python StateMachine Remote Code Execution via SCXML eval Injection Severity: Critical, CVSS 4.0 9.3 , CVSS 3.1 9.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

CVE-2014-7205

Bassmaster NodeJS Plugin RCE PoC bassmaster-rce.py: Un script en Python para explotar CVE-2014-7205. nodeshell.py: Un módulo Python para generar una reverse shell para NodeJS !!Úselo solo contra servidores en los que tenga permiso para realizar pruebas Resumen CVE-2014-7205 es una vulnerabilidad ...

CHIRP-CodeExecution_via_Malicious_ImageFile

CHIRP — Arbitrary Code Execution via eval in Kenwood ITM Driver Product: CHIRP - An open-source project for programming Ham Radios. Affected Versions: URL: https://github.com/kk7ds/chirp, https://chirpmyradio.com Affected Versions: = chirp-next-20260814 CWE: CWE-95 Eval Injection Overview CHIRP's...

cve-2024-36401-geoserver-rce

CVE-2024-36401 — Unauthenticated RCE in GeoServer A complete, reproducible study of CVE-2024-36401 , an unauthenticated remote code execution flaw in GeoServer — the most widely deployed open-source server for geospatial data. The bug is an eval injection : through the parameters of the OGC...

CVE-2025-2945

CVE-2025-2945 - pgAdmin4 Authenticated RCE Exploit Author: G0D150NE Version: 2.0.0 CVE: CVE-2025-2945 Severity: Critical CVSS 9.9 📌 Description Exploit for pgAdmin4 Remote Code Execution RCE vulnerability affecting versions 8.10 to 9.1. The vulnerability exists in the /sqleditor/querytool/downloa...

CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Remote Code Execution PoC Unauthenticated RCE vulnerability in Fuel CMS 1.4.1. The filter parameter in the /fuel/pages/select/ endpoint is passed unsanitized to a eval call in the PHP backend, allowing arbitrary code execution via a crafted payload. Unlike blind...

CVE-2025-2945-pgAdmin-RCE

CVE-2025-2945 — pgAdmin 4 Authenticated Query Tool RCE CVSS 3.1: 9.9 Critical · Affects: pgAdmin 4 8.10 – 9.1 · Fixed in: 9.2 April 4, 2025 CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code / Eval Injection A proof-of-concept exploit for CVE-2025-2945, an authenticated...

CVE-2026-23885

Security Advisory: CVE-2026-23885 Authenticated Remote Code Execution RCE in AlchemyCMS 1. Executive Summary A critical security vulnerability involving Improper Neutralization of Directives in Dynamically Evaluated Code CWE-95 was discovered in the AlchemyCMS framework. The vulnerability allows...

CVE-2026-69662 Toptech TMS7 and TopHAT Eval Injection

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions...

CVE-2026-69662 Toptech TMS7 and TopHAT Eval Injection

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions...

CVE-2026-69662

The Toptech TMS7 and TopHAT applications are vulnerable to an eval injection flaw due to the use of unsafe functions . These functions allow for the execution of inline scripts and string evaluation functions . While specific versions are not detailed in the provided text, a security strengthenin...

CVE-2026-100741

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

CVE-2026-100741

Progressive Robot Ltd's hMailServer (versions 6.0.0 through 6.3.3 on Windows) is vulnerable to Eval injection in the JScript event-script dispatcher. An unauthenticated remote attacker can execute arbitrary JScript within the hMailServer service process by sending a password containing a backslas...

CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

EUVD-2026-87904

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...