CWE-829 · Inclusion of Functionality from Untrusted Control Sphere (page 3)
Page 3 of 4 — CVEs classified under CWE-829, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27668 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Arbitrary Content Inclusion via Iframe OVE-20230524-00… |
CVE-2025-27510 | | 2025-03-04 | conda-forge-metadata provides programatic access to conda-forge's metadata. conda-forge-metadata uses an optional dependency - "conda-oci-mirror" which was nei… | |
CVE-2024-13353 | High | 8.8 | 2025-02-21 | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Local File Inclusion in all ve… |
CVE-2024-31144 | Low | 3.8 | 2025-02-14 | For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.html#object-model-overview Xapi contains functionality to b… |
CVE-2025-0982 | Critical | 10.0 | 2025-02-06 | Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScr… |
CVE-2024-49649 | Critical | 9.8 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-… |
CVE-2024-56216 | Medium | 6.5 | 2024-12-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder themify-buil… |
CVE-2024-54663 | High | 7.5 | 2024-12-19 | An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the… |
CVE-2024-48336 | High | 8.4 | 2024-11-04 | The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local… |
CVE-2024-50497 | High | 8.1 | 2024-10-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wdesco Advanced Online Ordering and De… |
CVE-2024-49243 | High | 7.5 | 2024-10-18 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ramjon27 Dynamic Elementor Addons dyna… |
CVE-2024-30092 | High | 8.0 | 2024-10-08 | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2022-49038 | High | 7.8 | 2024-09-26 | Inclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component in Synology Drive Client before 3.3.0-15082 allows local users… |
CVE-2024-45416 | High | 8.1 | 2024-09-16 | The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory… |
CVE-2024-43690 | High | 8.0 | 2024-09-11 | Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Ex… |
CVE-2024-8252 | High | 8.8 | 2024-08-30 | The Clean Login plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.14.5 via the 'template' attribute of the cle… |
CVE-2024-5762 | High | 8.1 | 2024-08-21 | Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2024-4359 | Medium | 6.5 | 2024-08-12 | The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to arbitrary fil… |
CVE-2024-29073 | Medium | 5.3 | 2024-07-22 | An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes… |
CVE-2024-38537 | Unrated | | 2024-07-02 | Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the… |
CVE-2024-38476 | Critical | 9.8 | 2024-07-01 | Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend application… |
CVE-2024-3043 | High | 7.5 | 2024-06-27 | An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their network identifier (pan ID), leading to a… |
CVE-2024-5693 | Medium | 6.1 | 2024-06-11 | Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. T… |
CVE-2024-35650 | Medium | 4.9 | 2024-06-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Melapress MelaPress Login Security mel… |
CVE-2024-35629 | Critical | 9.6 | 2024-06-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Easy Digital Downloads – R… |
CVE-2023-49134 | High | 8.1 | 2024-04-09 | A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0… |
CVE-2023-49133 | High | 8.1 | 2024-04-09 | A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0… |
CVE-2024-28184 | High | 7.4 | 2024-03-09 | WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs… |
CVE-2024-24821 | High | 8.8 | 2024-02-09 | Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation… |
CVE-2022-31021 | Low | 3.3 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. A weakness in the Hyperledger AnonCreds specification that is not mitigated in the Ursa and AnonCreds… |
CVE-2023-6971 | High | 8.1 | 2023-12-23 | The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it po… |
CVE-2023-4591 | High | 7.5 | 2023-11-03 | A local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local… |
CVE-2023-45798 | High | 8.4 | 2023-10-30 | In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load… |
CVE-2023-33559 | High | 8.8 | 2023-10-26 | A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file. |
CVE-2023-5523 | High | 8.6 | 2023-10-20 | Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote… |
CVE-2023-4488 | Critical | 9.8 | 2023-10-20 | The Dropbox Folder Share for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.9.7 via the editor-view.php file. This allows… |
CVE-2023-0625 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects Docker Desktop: before 4.12.0. |
CVE-2023-41267 | High | 7.8 | 2023-09-14 | In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was… |
CVE-2023-2453 | High | 8.8 | 2023-09-05 | There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement… |
CVE-2023-31170 | Medium | 5.9 | 2023-08-31 | An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software co… |
CVE-2023-31168 | Medium | 5.5 | 2023-08-31 | An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software co… |
CVE-2023-40195 | High | 8.8 | 2023-08-28 | Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Pr… |
CVE-2023-36609 | High | 7.2 | 2023-07-03 | The affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and pu… |
CVE-2023-2249 | High | 8.8 | 2023-06-09 | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and includi… |
CVE-2023-2551 | High | 8.8 | 2023-05-05 | PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1. |
CVE-2022-46302 | High | 8.8 | 2023-04-20 | Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe… |
CVE-2022-30037 | High | 7.2 | 2023-03-23 | XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the add function in cro… |
CVE-2022-4134 | Low | 2.8 | 2023-03-06 | A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual mach… |
CVE-2023-26053 | Medium | 6.6 | 2023-03-02 | Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP key… |
CVE-2022-41216 | High | 8.3 | 2023-02-22 | Local File Inclusion vulnerability within Cloudflow allows attackers to retrieve confidential information from the system. |
CVE-2023-21440 | Medium | 6.2 | 2023-02-09 | Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture. |
CVE-2022-24119 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell. This affects iNET… |
CVE-2022-34468 | High | 8.8 | 2022-12-22 | An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. This vulnerability affects Firefox < 102, F… |
CVE-2022-41709 | High | 7.8 | 2022-10-19 | Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Mar… |
CVE-2022-22246 | High | 7.5 | 2022-10-18 | A PHP Local File Inclusion (LFI) vulnerability in the J-Web component of Juniper Networks Junos OS may allow a low-privileged authenticated attacker to execute… |
CVE-2022-37191 | Medium | 6.5 | 2022-09-13 | The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function… |
CVE-2022-34121 | High | 7.5 | 2022-07-27 | Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php. |
CVE-2022-33317 | High | 7.8 | 2022-07-20 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics… |
CVE-2022-30244 | High | 8.0 | 2022-07-15 | Honeywell Alerton Ascent Control Module (ACM) through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be store on… |
CVE-2022-30243 | High | 8.8 | 2022-07-15 | Honeywell Alerton Visual Logic through 2022-05-04 allows unauthenticated programming writes from remote users. This enables code to be stored on the controller… |
CVE-2022-31156 | Medium | 6.6 | 2022-07-14 | Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies eit… |
CVE-2021-41037 | Critical | 10.0 | 2022-07-08 | In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoin… |
CVE-2021-4229 | Medium | 5.0 | 2022-05-24 | A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a… |
CVE-2022-29845 | Medium | 6.5 | 2022-05-11 | In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow the… |
CVE-2022-24824 | Medium | 5.3 | 2022-04-14 | Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) users… |
CVE-2022-1161 | Critical | 10.0 | 2022-04-11 | An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5… |
CVE-2022-25486 | High | 7.8 | 2022-03-15 | CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php. |
CVE-2022-25485 | High | 7.8 | 2022-03-15 | CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php. |
CVE-2022-24329 | Medium | 5.3 | 2022-02-25 | In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. |
CVE-2022-24232 | High | 7.8 | 2022-02-24 | A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-22308 | High | 7.8 | 2022-02-21 | IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. User input could be passed into file include commands and the web application c… |
CVE-2022-23630 | High | 7.5 | 2022-02-10 | Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept… |
CVE-2021-41841 | High | 8.2 | 2022-02-03 | An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System M… |
CVE-2021-42133 | High | 8.1 | 2021-12-07 | An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform an arbitr… |
CVE-2021-29113 | Medium | 4.7 | 2021-12-07 | A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html int… |
CVE-2021-41256 | Medium | 5.8 | 2021-11-30 | nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issu… |
CVE-2021-20843 | Medium | 5.4 | 2021-11-24 | Cross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15.00.19 and earlier… |
CVE-2021-41569 | High | 7.5 | 2021-11-19 | SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included by default) in the appstart.sas file, allows end-users of the… |
CVE-2020-16152 | Critical | 9.8 | 2021-11-14 | The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP cod… |
CVE-2021-33626 | High | 7.8 | 2021-10-01 | A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer… |
CVE-2021-38360 | High | 8.3 | 2021-09-10 | The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser.php file which all… |
CVE-2021-32802 | Critical | 9.3 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some image type… |
CVE-2021-34398 | High | 7.8 | 2021-08-13 | NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared libraries into the DCGM server, which is… |
CVE-2021-21804 | Critical | 9.8 | 2021-07-16 | A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP… |
CVE-2021-34692 | High | 7.8 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. A local and low-privileged user can force RemotePC to execute an attacker-controlled exec… |
CVE-2021-30121 | Medium | 6.5 | 2021-07-09 | Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/… |
CVE-2021-29777 | Medium | 6.5 | 2021-06-24 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table being dropped while b… |
CVE-2020-25414 | Critical | 9.8 | 2021-06-17 | A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code. |
CVE-2021-3603 | High | 8.1 | 2021-06-17 | PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by o… |
CVE-2021-30507 | High | 8.8 | 2021-06-04 | Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process t… |
CVE-2020-4561 | Critical | 10.0 | 2021-06-01 | IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This allows a remote attacker who can access… |
CVE-2021-29427 | High | 8.0 | 2021-04-13 | In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository con… |
CVE-2020-24985 | High | 8.1 | 2021-03-15 | An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and cha… |
CVE-2021-28162 | Medium | 6.1 | 2021-03-12 | In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run. |
CVE-2020-22474 | Medium | 6.5 | 2021-02-22 | In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion. |
CVE-2021-20443 | High | 8.8 | 2021-02-18 | IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is outside of the intended control sphere. I… |
CVE-2021-20187 | High | 7.2 | 2021-01-28 | It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP i… |
CVE-2021-26272 | Medium | 6.5 | 2021-01-26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then pr… |
CVE-2021-26271 | Medium | 6.5 | 2021-01-26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dia… |
CVE-2020-29072 | Medium | 6.1 | 2020-11-25 | A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and succ… |