CVE-2007-1253

CVE-2007-1253 affects Blender up to version 2.43, via the kmz_ImportWithMesh.py script. An insecure use of eval() in kmz_ImportWithMesh.py allows a remote attacker to entice a user to open a crafted .kmz or .kml file, resulting in arbitrary Python code execution with the user’s privileges. The vu...

Sql injection

Multiple eval injection vulnerabilities in Vote! Pro 4.0, and possibly earlier, allow remote attackers to execute arbitrary code via requests to unspecified PHP scripts with the pollid parameter, which is supplied to eval function calls, a different set of vectors than CVE-2007-0504. NOTE: The...

CVE-2007-0535

Multiple eval injection vulnerabilities in Vote! Pro 4.0, and possibly earlier, allow remote attackers to execute arbitrary code via requests to unspecified PHP scripts with the pollid parameter, which is supplied to eval function calls, a different set of vectors than CVE-2007-0504. NOTE: The...

CVE-2007-0535

Multiple eval injection vulnerabilities in Vote! Pro 4.0, and possibly earlier, allow remote attackers to execute arbitrary code via requests to unspecified PHP scripts with the pollid parameter, which is supplied to eval function calls, a different set of vectors than CVE-2007-0504. NOTE: The...

CVE-2007-0535

CVE-2007-0535 (and related CVE-2007-0504) affect Vote! Pro 4.0 and possibly earlier, via eval injection in poll_frame.php where the poll_id parameter is passed to eval. This allows remote attackers to execute arbitrary code due to unsanitized input in PHP scripts; vectors are not fully detailed b...

Sql injection

Eval injection vulnerability in pollframe.php in Vote! Pro 4.0, and possibly other scripts, allows remote attackers to execute arbitrary code via the pollid parameter, which is supplied to an eval function call, a different vulnerability type than CVE-2005-4632...

CVE-2007-0504

Eval injection vulnerability in pollframe.php in Vote! Pro 4.0, and possibly other scripts, allows remote attackers to execute arbitrary code via the pollid parameter, which is supplied to an eval function call, a different vulnerability type than CVE-2005-4632...

CVE-2007-0504

Eval injection vulnerability in pollframe.php in Vote! Pro 4.0, and possibly other scripts, allows remote attackers to execute arbitrary code via the pollid parameter, which is supplied to an eval function call, a different vulnerability type than CVE-2005-4632...

EUVD-2007-0502

Eval injection vulnerability in pollframe.php in Vote! Pro 4.0, and possibly other scripts, allows remote attackers to execute arbitrary code via the pollid parameter, which is supplied to an eval function call, a different vulnerability type than CVE-2005-4632...

CVE-2007-0504

CVE-2007-0504 is an eval-injection vulnerability in Vote! Pro 4.0 (poll_frame.php and possibly other scripts). It allows remote attackers to execute arbitrary code by supplying a malicious poll_id that is passed to an eval() call. Descriptions from connected records confirm the poll_id/eval vecto...

Vote!Pro eval()调用代码注入漏洞

Vote!Pro是一个可以自定义的在线投票和调查程序。 Vote!Pro处理有用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 Vote!Pro的pollframe.php文件没有正确地过滤eval调用所使用的pollid参数，允许攻击者通过提交特制的参数值注入并执行任意PHP代 Vote! Pro 4.0 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.vote-pro.com/ http://www.sebug.net/show-exp-995.html...

CVE-2007-0134

Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in 1 cart.php and 2 page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1...

Sql injection

Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in 1 cart.php and 2 page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1...

CVE-2007-0134

Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to an eval function call in 1 cart.php and 2 page.php. NOTE: a later report and CVE analysis indicate that the vulnerability is present in 1...

CVE-2007-0134

The CVE-2007-0134 issue affects iGeneric iG Shop, originally version 1.0. It enables remote code execution via eval in the action parameter passed to eval call sites in cart.php and page.php. A later report notes the vulnerability is also present in version 1.4. The connected sources consistently...

igshop10-multiple.txt

"If eval is the answer, then you are asking the wrong question." --Unknowen ig-shop suffers from two eval's that can be controlled by an attacker: http://127.0.0.1/igshop/cart.php?action=;phpinfo;// ./cart.php line 692: eval "cart$action;"; http://127.0.0.1/igshop/page.php?action=;phpinfo;//...

iG Shop 1.0 Multiple Remote Vulnerabilities

"If eval is the answer, then you are asking the wrong question." --Unknowen ig-shop suffers from two eval's that can be controlled by an attacker: http://127.0.0.1/igshop/cart.php?action=;phpinfo;// ./cart.php line 692: eval "cart$action;"; http://127.0.0.1/igshop/page.php?action=;phpinfo;//...

ig shop 1.0 - Code Execution / SQL Injection

"If eval is the answer, then you are asking the wrong question." --Unknowen ig-shop suffers from two eval's that can be controlled by an attacker: http://127.0.0.1/igshop/cart.php?action=;phpinfo;// ./cart.php line 692: eval "cart$action;"; http://127.0.0.1/igshop/page.php?action=;phpinfo;//...

iG Shop 1.0 (eval/sql injection) Multiple Remote Vulnerabilities

No description provided by source. "If eval is the answer, then you are asking the wrong question." --Unknowen ig-shop suffers from two eval's that can be controlled by an attacker: http://127.0.0.1/igshop/cart.php?action=;phpinfo;// ./cart.php line 692: eval "cart$action;";...

CVE-2006-6852

tDiary 2.0.3 and 2.1.4.200 contain an eval injection vulnerability that lets a remote authenticated attacker run arbitrary Ruby scripts. The root cause is described as incorrect input validation in two web templates (conf.rhtml and i.conf.rhtml), enabling arbitrary code execution on the web serve...