Do nulled scripts contain malware?

Some of the nulled scripts contain a shell exploit... when you upload the script to hosting they can have access to full root prem. and some have an option to send submitted data and data in the server.