CVE-2026-47670

CVE-2026-47670 تنفيذ كود عن بُعد بعد المصادقة عبر حقن كود في معامل functionName في دالة loadReader في DbGate DbGate هو أداة مفتوحة المصدر لإدارة قواعد البيانات تعمل عبر المنصات، صُممت للمطورين ومسؤولي قواعد البيانات الذين يحتاجون إلى العمل مع أنظمة قواعد بيانات متعددة في وقت واحد. يوفر واجهة موحد...

CVE-2026-48017

CVE-2026-48017 — Esecuzione di codice remoto in DbGate tramite injection in functionName Gravità : Alta CVSS 8.8 CWE : CWE-94 — Controllo improprio della generazione di codice 'Code Injection' Versioni interessate : dbgate-api ≤ 7.1.8 corretta in 7.1.9 Advisory : GHSA-hv83-ggc4-v385 NVD :...

CVE-2026-47670

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...

CVE-2026-47668

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

CVE-2026-47668

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

CVE-2026-47668 DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

CVE-2026-47668

DbGate (dbgate-serve) up to v7.1.8 is affected by a critical RCE in the JSON Script Runner. User-controlled fields (functionName, and also variableName in assign commands) are concatenated into dynamically generated JavaScript and executed in a forked Node.js process, enabling arbitrary command e...

CVE-2026-48017 DbGate: Remote Code Execution via functionName injection in loadReader endpoint

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...

Arbitrary Code Injection

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Arbitrary Code Injection in the loadReader function in runners.js. The functionName parameter can be injected with arbitrary JavaScript, which is executed with the privileges...

GHSA-8V3Q-9VMX-36VC DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

Summary DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The...

CVE-2019-10777

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

GHSA-HPR6-F4VQ-MXCH Command injection in LocalStack

The dashboard component of StackLift LocalStack allows attackers to inject arbitrary shell commands via the functionName parameter...

CVE-2021-32090

The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter...

CVE-2021-32090

The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter...

CVE-2021-32090

The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter...

CVE-2019-10777

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName"...

CVE-2018-5358

ImageMagick 7.0.7-22 Q16 has memory leaks in the EncodeImageAttributes function in coders/json.c, as demonstrated by the ReadPSDLayersInternal function in coders/psd.c...

win32/xp sp2 Pop up message box 110 bytes

win32/xp sp2 Pop up message box 110 bytes. Shellcode exploit for win32 platform / Author : Omega7 Assembly Code : Steve Hanna Changed by : Omega7 Description : It is 110 Byte Shellcode which Pops up Message Box Under Windows Xp SP2 If you Want to use it in any other Windows You need to change the...