CVE-2026-33625

LMDeploy versions 0.12.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py (line 620). The quant_dtype value from a model's HuggingFace quantization_config is passed to eval(f'torch.{quant_dtype}') without validation, enabling an attacker who publishes a maliciou...

LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

Summary lmdeploy = latest contains a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantizationconfig.quantdtype value. When a user loads the model with...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837

XWiki Rendering (org.xwiki.rendering:xwiki-rendering-xml) is affected by an Eval Injection flaw prior to versions 14.10.2 and 15.0 RC1 . Rendering output is included as content of HTML macros without further escaping, allowing an attacker who can edit a document (e.g., their own profile) to close...

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-45149 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max...

moodle-rce-calculatedquestions

Scripts to Test Input Validation in Moodle Calculated Questions CVE-2024-43425 This repository contains the companion scripts to the blog post Back to School - Exploiting a Remote Code Execution Vulnerability in Moodle, which describes a remote code execution vulnerability in the Moodle learning...

collision-webshell

Webshell 碰撞 此仓库包含 2 个具有相同 MD5 哈希的文件： webshell.php normal.php 文件的 MD5： root@kitploit: $ md5sum .php b719a17ae091ed45fb874c15b2d9663f normal.php b719a17ae091ed45fb874c15b2d9663f webshell.php webshell.php 的 Hexdump： root@kitploit: $ hexdump -C webshell.php 00000000 3c 3f 3d 65 76 61 6c 28 24 5f 47 4...

EulerOS Virtualization 2.12.1 : perl-IO-Compress (EulerOS-SA-2026-3607)

According to the versions of the perl-IO-Compress package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled outp...

EulerOS Virtualization 2.12.0 : perl-IO-Compress (EulerOS-SA-2026-3661)

According to the versions of the perl-IO-Compress package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled outp...

EulerOS 2.0 SP10 : perl-IO-Compress (EulerOS-SA-2026-3759)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob...

EulerOS 2.0 SP10 : perl-IO-Compress (EulerOS-SA-2026-3712)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob...

CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Remote Code Execution PoC Unauthenticated RCE vulnerability in Fuel CMS 1.4.1. The filter parameter in the /fuel/pages/select/ endpoint is passed unsanitized to a eval call in the PHP backend, allowing arbitrary code execution via a crafted payload. Unlike blind...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

CVE-2025-2945-pgAdmin-RCE

CVE-2025-2945 — pgAdmin 4 查询工具认证远程代码执行 CVSS 3.1：9.9（严重） · 影响范围： pgAdmin 4 8.10 – 9.1 · 修复版本： 9.2（2025年4月4日） CWE-95 （动态求值代码中指令的不当中和 / 求值注入） 这是针对 CVE-2025-2945 的概念验证漏洞利用程序，该漏洞是 pgAdmin 4 查询工具中的一个认证远程代码执行漏洞。一个布尔事务状态标志（querycommited）被直接传入 Python 的 eval 函数，而非被解析为布尔值，从而允许已认证用户以 pgAdmin 服务进程的权限执行任意 Pyth...

CVE-2026-8838-RCE

CVE-2026-8838 — Amazon Redshift Python Driver: Remote Code Execution via eval ⚠️ Educational Use Only Research and demonstration project in offensive cybersecurity conducted exclusively for educational and awareness purposes. Any use on systems without explicit authorization is illegal. This...

CVE-2026-29053

CVE-2026-29053 通过 jsonpath/static-eval 原型链实现 Ghost CMS RCE。 信息 CVE ：CVE-2026-29053 受影响版本 ：Ghost -p 1. 启动监听器：nc -lvnp 2. 上传 malicious-theme.zip 到 Ghost 管理后台 → 设置 → 设计 3. 创建 slug 为 rce 的页面 4. 访问 /rce/ 参考 https://github.com/TryGhost/Ghost/security/advisories/GHSA-cgc2-rcrh-qr5x...

CVE-2026-3395-Lab

CVE-2026-3395 — Laboratorio de RCE no autenticado en MaxSite CMS Este repositorio es solo para fines educativos y de investigación. Todas las pruebas deben realizarse en un entorno de laboratorio Docker local. No implemente esta configuración en sistemas públicos o de producción. Resumen...

CVE-2025-60595

CVE-2025-60595 SPH Engineering UgCS 5.13.0 es vulnerable a la ejecución arbitraria de código. Esta es la referencia pública que se utilizará en el sitio de CVE. ¡Ejecución arbitraria de código en el producto propiedad de SPH Engineering. UGCS 5.13.0! Ardupilot/mavparse.py, líneas directas 230 "24...