4243 matches found
CVE-2025-67031
ORSEE Online Recruitment System for Economic Experiments 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem. Certain field configurations accept values beginning with the prefix "func:" which are passed directly into an eval...
Online Recruitment System for Economic Experiments 安全漏洞
Online Recruitment System for Economic Experiments is an open-source online recruitment system for economic experiments developed by ORSEE. Version 3.1.0 of Online Recruitment System for Economic Experiments contains a security vulnerability. This vulnerability stems from the fact that values...
CVE-2025-67031
ORSEE Online Recruitment System for Economic Experiments 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem. Certain field configurations accept values beginning with the prefix "func:" which are passed directly into an eval...
CVE-2025-67031
ORSEE Online Recruitment System for Economic Experiments 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem. Certain field configurations accept values beginning with the prefix "func:" which are passed directly into an eval...
PT-2026-41319
Name of the Vulnerable Software and Affected Versions MCP Calculate Server versions prior to 0.1.1 Description Insufficient input sanitization when using the eval function to evaluate mathematical expressions allows for remote code execution. Recommendations Update to version 0.1.1...
MCP Calculate Server 代码注入漏洞
MCP Calculate Server is a mathematical calculation service tool developed by 611711Dark, based on the MCP protocol. Versions of MCP Calculate Server prior to 0.1.1 contained a code injection vulnerability. This vulnerability arose from the use of eval to evaluate mathematical expressions without...
Malicious code in ethers-signing-key (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6735be7311be4f6b4f609762cfb77504fe141bc9d8d5b5c0a75d521119aa2fa The package's npm postinstall hook executes a one-liner that uses childprocess.exec to curl/wget an unpinned Python script from a personal user's...
MAL-2026-3774 Malicious code in ts-build-optimize (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51c637ab7c13ca2f592502f3444ebb24b291422b6388563d04fb8f7ae9030d5a The package masquerades as a TypeScript helper library README is lifted from Microsoft's tslib and references --importHelpers, extends, assign, and a...
WS-2020-0077
safe-eval through 0.4.1 is vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system...
WS-2020-0075
@zhaoyao91/eval-in-vm through 0.0.0 ia vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through this.constructor.constructor . This may allow attackers to execute arbitrary code in the system. Evaluating the payload...
WS-2017-0242
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0241
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0243
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0245
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0244
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0223
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0246
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0240
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2017-0221
Affected versions of the package are vulnerable to Arbitrary Code Injection due to unsafe use of the eval function...
WS-2016-0138
Running eval represent a security threat as the interpreter can be hijacked by the service returning the string getting "evaled", in this case Presto. It turns out the code I'm changing here was written a long time ago and misguided, casting a python object to a string and then evaling it as a...