CVE-2026-69662 Toptech TMS7 and TopHAT Eval Injection

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions...

CVE-2023-43364-Searchor-RCE-Exploit

CVE-2023-43364 – Exploit RCE de Searchor PoC Ejecución Remota de Código RCE mediante uso inseguro de eval en Searchor --test Ejecutar comando personalizado Ejecutar cualquier comando en el servidor objetivo: python3 CVE-2023-43364.py -a "whoami" Ejemplos: python3 CVE-2023-43364.py -a "TF=$mktemp...

CVE-2026-48962

Resumen Una vulnerabilidad de inyección en eval en File::GlobMapper::getFiles permite a cualquier atacante que pueda controlar el argumento fileglob de salida pasado a IO::Compress::Gzip::gzip, IO::Compress::Zip::zip, o cualquier función relacionada, ejecutar código Perl arbitrario en el contexto...

proofpoint-CVE-2023-0090

Acerca de Investigador de seguridad: ly1g3, ly1g3attuta.io Huella GPG: https://keys.openpgp.org/vks/v1/by-fingerprint/5FE85CE4E8F675F5ABD2C0A33CE8BE447ED6D586 Resumen: Ejecución Remota de Código - RCE sin autenticación CVE: CVE-2023-0090 Cronología: Descubierto - ly1g3 Reportado - ly1g3 Corregido...

CVE-2023-43364-Exploit-CVE

CVE-2023-43364-Exploit-CVE Este es un script de Python para explotar Searchor 2.4.0: la función eval fue implementada de forma insegura y puede ser explotada para RCE. Esta máquina depende de que busybox esté instalado, ya que escribí esto para la máquina Busqueda de HackTheBox. Simplemente...

Ultimate-CVE-2026-61511

CVE-2026-61511 – Prueba de concepto Prueba de concepto PoC educativa y defensiva para validar la exposición a la vulnerabilidad de vBulletin CVE-2026-61511 – Ejecución remota de código no autenticada. Contacto Telegram: https://t.me/thecodeb0ss Resumen Este repositorio proporciona una prueba de...

Reproduce-CVE-2024-21513

Reproduce-CVE-2024-21513 Overview This project demonstrates the vulnerability CVE-2024-21513 in the langchain-experimental package, specifically in versions =0.0.15 and 0.0.21. The vulnerability allows arbitrary code execution via the VectorSQLDatabaseChain component when retrieving values from t...

sk-cve-2026-26030-lab

CVE-2026-26030 — Filtro eval RCE en Semantic Kernel laboratorio Un laboratorio autocontenido que reproduce CVE-2026-26030 : ejecución remota de código inyectable mediante el filtro de búsqueda en el almacén de vectores en memoria de Microsoft Semantic Kernel Python, Solo laboratorio ético. Aislad...

CVE-2025-50881

CVE-2025-50881: Remote Code Execution in API Use it Flow via moniteur.php Identifier: CVE-2025-50881 Affected Product: API Use it Flow Version 8.2.0 Rev 15851, Version 9.2.0 Rev 18093 Editor: https://www.tenorsolutions.com formerly https://api-sas.fr/ Affected Components: flow/admin/moniteur.php...

CVE-2026-9147-uproot-rce

CVE-2026-9147: inyección de código en uproot mediante metadatos TStreamerInfo Gravedad: Alta, CVSS 4.0 8.5 , CVSS 3.1 7.8 asignada por VulnCheck, la CNA Vector v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Afectados...

CVE-2026-100741

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

CVE-2026-44262

dedoc/scramble RCE CVE-2026-44262 PoC 📜 Descripción CVE-2026-44262 es una vulnerabilidad de Ejecución Remota de Código sin autenticación en dedoc/scramble, un generador de documentación de API de Laravel. NodeRulesEvaluator::doEvaluateExpression llama a extract$variables antes de eval"return...

CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

CVE-2026-100741

Progressive Robot Ltd's hMailServer (versions 6.0.0 through 6.3.3 on Windows) is vulnerable to Eval injection in the JScript event-script dispatcher. An unauthenticated remote attacker can execute arbitrary JScript within the hMailServer service process by sending a password containing a backslas...

CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

EUVD-2026-87904

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

CVE-2026-47103-python-statemachine-rce

CVE-2026-47103: Ejecución remota de código en Python StateMachine mediante inyección de eval en SCXML Gravedad: Crítica, CVSS 4.0 9.3 , CVSS 3.1 9.8 asignado por VulnCheck, el CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1:...

CVE-2026-100842

MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval...

CVE-2026-100842 MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains

MONAI through 1.6.0 contains an eval injection vulnerability in getfakespatialshape in monai/bundle/scripts.py. The function validates shape expressions with a helper that walks the AST and only collects ast.Name nodes, rejecting any name other than 'p' or 'n', before passing the string to eval...