1 matches found
ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)
ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. ScriptTriggerExecutor.java:56; trigger creation is gated only at UPDATESCHEMA LocalSchema.createTrigger:636. Permitting java.lang. host-class lookup lets a trigger script do...
6.1AI score
SaveExploits0References3Affected Software1
20