CWE-94 · Code Injection (page 11)
Page 11 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3741 | Low | 3.5 | 2026-03-08 | A security vulnerability has been detected in YiFang CMS 2.0.5. The affected element is the function update of the file app/db/admin/D_friendLink.php. Such man… |
CVE-2026-3721 | Low | 3.5 | 2026-03-08 | A weakness has been identified in 1024-lab/lab1024 SmartAdmin up to 3.29. The affected element is an unknown function of the file sa-base/src/main/java/net/lab… |
CVE-2026-3720 | Low | 3.5 | 2026-03-08 | A security flaw has been discovered in 1024-lab/lab1024 SmartAdmin up to 3.29. Impacted is an unknown function of the file smart-admin-web-javascript/src/views… |
CVE-2026-3716 | Low | 2.4 | 2026-03-08 | A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This vulnerability affects the function sub_401AD4 of the file /cgi-bin/adm.cgi. Executing a man… |
CVE-2026-3702 | Medium | 4.3 | 2026-03-08 | A vulnerability was detected in SourceCodester Loan Management System 1.0. Affected by this issue is some unknown functionality of the file /index.php. Perform… |
CVE-2026-3352 | High | 7.2 | 2026-03-07 | The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0.4 via the `update_wp_memory_constants(… |
CVE-2026-29091 | High | 8.1 | 2026-03-06 | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was di… |
CVE-2026-29075 | High | 8.3 | 2026-03-06 | Mesa is an open-source Python library for agent-based modeling, simulating complex systems and exploring emergent behaviors. In version 3.5.0 and prior, checki… |
CVE-2026-2830 | Medium | 6.1 | 2026-03-06 | The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘filepa… |
CVE-2026-29039 | High | 7.5 | 2026-03-06 | changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, the changedetection.io application allows users to specify XP… |
CVE-2026-28801 | Medium | 6.6 | 2026-03-06 | Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, any ahk code contained inside of a pattern or path file… |
CVE-2026-25888 | High | 8.8 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is… |
CVE-2026-25887 | High | 7.2 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is… |
CVE-2026-3610 | Medium | 4.3 | 2026-03-06 | A vulnerability was found in HSC Cybersecurity Mailinspector up to 5.3.2-3. Affected by this issue is some unknown functionality of the file /mailinspector/mli… |
CVE-2025-70995 | High | 8.8 | 2026-03-05 | An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of upload… |
CVE-2026-28134 | High | 8.5 | 2026-03-05 | Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetE… |
CVE-2026-27984 | Critical | 9.0 | 2026-03-05 | Improper Control of Generation of Code ('Code Injection') vulnerability in Marketing Fire Widget Options widget-options allows Code Injection.This issue affect… |
CVE-2026-22390 | Critical | 9.9 | 2026-03-05 | Improper Control of Generation of Code ('Code Injection') vulnerability in Builderall Builderall Builder for WordPress builderall-cheetah-for-wp allows Code In… |
CVE-2026-28783 | Critical | 9.1 | 2026-03-04 | Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, Craft CMS implements a blocklist to prevent potentially dangerous PHP func… |
CVE-2026-23808 | Medium | 5.4 | 2026-03-04 | A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Tem… |
CVE-2025-70341 | High | 7.8 | 2026-03-04 | Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files. |
CVE-2024-55022 | High | 8.8 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Name parameter. |
CVE-2023-31044 | Low | 2.0 | 2026-03-03 | An issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a remote authenticated user, using the Add Campaign functionality, ca… |
CVE-2025-59059 | Critical | 9.8 | 2026-03-03 | Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2… |
CVE-2026-21853 | High | 8.8 | 2026-03-02 | AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerability. This… |
CVE-2026-3132 | High | 8.8 | 2026-03-02 | The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_… |
CVE-2026-24105 | Critical | 9.8 | 2026-03-02 | An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command in… |
CVE-2026-26720 | Critical | 9.8 | 2026-03-02 | An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module. |
CVE-2026-26699 | High | 7.2 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php. |
CVE-2026-24107 | Critical | 9.8 | 2026-03-02 | An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of `usbPartitionName`, which is directly used in `doSystemCmd`, may lead… |
CVE-2026-3412 | Medium | 4.3 | 2026-03-02 | A vulnerability was detected in itsourcecode University Management System 1.0. This affects an unknown part of the file /att_single_view.php. The manipulation… |
CVE-2026-3409 | High | 7.3 | 2026-03-02 | A security flaw has been discovered in eosphoros-ai db-gpt 0.7.5. Affected is the function importlib.machinery.SourceFileLoader.exec_module of the file /api/v1… |
CVE-2026-3403 | Low | 2.4 | 2026-03-02 | A vulnerability was detected in PHPGurukul Student Record Management System 1.0. This issue affects some unknown processing of the file /edit-subject.php. Perf… |
CVE-2026-3402 | Low | 2.4 | 2026-03-02 | A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code of the file /edit-… |
CVE-2026-3395 | High | 7.3 | 2026-03-01 | A flaw has been found in MaxSite CMS up to 109.1. This impacts the function eval of the file application/maxsite/admin/plugins/editor_markitup/preview-ajax.php… |
CVE-2026-28425 | High | 8.0 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, an authenticated control panel user with access to… |
CVE-2026-21658 | Critical | 9.8 | 2026-02-27 | Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD… |
CVE-2026-21657 | Critical | 9.8 | 2026-02-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient valid… |
CVE-2026-21656 | Critical | 9.8 | 2026-02-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient valid… |
CVE-2026-3302 | Medium | 4.3 | 2026-02-27 | A weakness has been identified in SourceCodester Doctor Appointment System 1.0. Affected by this issue is some unknown functionality of the file /register.php… |
CVE-2026-26682 | High | 7.8 | 2026-02-26 | An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component |
CVE-2026-27966 | Critical | 9.8 | 2026-02-26 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerou… |
CVE-2026-27952 | High | 8.8 | 2026-02-26 | Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluato… |
CVE-2026-27830 | High | 8.0 | 2026-02-26 | c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Severa… |
CVE-2026-27577 | Critical | 9.9 | 2026-02-25 | n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have… |
CVE-2026-27498 | High | 8.8 | 2026-02-25 | n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows co… |
CVE-2026-27497 | High | 8.8 | 2026-02-25 | n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify wo… |
CVE-2026-27495 | Critical | 9.9 | 2026-02-25 | n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify wo… |
CVE-2026-27493 | Critical | 9.0 | 2026-02-25 | n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expression injection vulnerability existed in… |
CVE-2026-27702 | Critical | 9.9 | 2026-02-25 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase… |
CVE-2026-27701 | | 2026-02-25 | LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveCode's `i18n-update-pull` GitHub Actions… | |
CVE-2026-3171 | Low | 3.5 | 2026-02-25 | A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2026-1929 | High | 8.8 | 2026-02-25 | The Advanced Woo Labels plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.37. This is due to the use of `call… |
CVE-2026-3170 | Low | 2.4 | 2026-02-25 | A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected is an unknown function of the file /pa… |
CVE-2026-27745 | High | 8.8 | 2026-02-25 | The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface w… |
CVE-2026-27744 | Critical | 9.8 | 2026-02-25 | The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket… |
CVE-2026-27597 | Critical | 10.0 | 2026-02-25 | Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to version 2.11.1, it is possible to escape the security boundraries se… |
CVE-2024-56373 | High | 8.4 | 2026-02-24 | DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context… |
CVE-2026-3070 | Medium | 4.3 | 2026-02-24 | A vulnerability was detected in SourceCodester Modern Image Gallery App 1.0. Affected by this vulnerability is an unknown functionality of the file upload.php… |
CVE-2026-3054 | Medium | 4.3 | 2026-02-24 | A vulnerability was identified in Alinto SOGo 5.12.3/5.12.4. This impacts an unknown function. The manipulation of the argument hint leads to cross site script… |
CVE-2026-3050 | Low | 3.5 | 2026-02-24 | A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of the component Leads… |
CVE-2026-25797 | Medium | 5.7 | 2026-02-24 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, respons… |
CVE-2025-9120 | | 2026-02-24 | Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows Code Injection. The vulnerability co… | |
CVE-2026-3043 | Medium | 4.3 | 2026-02-24 | A flaw has been found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/navbar.php. Executing a manip… |
CVE-2026-3041 | Low | 2.4 | 2026-02-23 | A security vulnerability has been detected in xingfuggz BaykeShop up to 1.3.20. Impacted is an unknown function of the file src/baykeshop/contrib/article/templ… |
CVE-2026-3028 | Medium | 4.3 | 2026-02-23 | A vulnerability was determined in erzhongxmu JEEWMS up to 3.7. This vulnerability affects the function doAdd of the file src/main/java/com/jeecg/demo/controlle… |
CVE-2026-3027 | Medium | 4.3 | 2026-02-23 | A vulnerability was found in erzhongxmu JEEWMS up to 3.7. This affects an unknown part of the file src/main/webapp/plug-in/ueditor/jsp/getContent.jsp of the co… |
CVE-2025-70328 | High | 8.8 | 2026-02-23 | TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The h… |
CVE-2026-2972 | Low | 2.4 | 2026-02-23 | A vulnerability was determined in a466350665 Smart-SSO up to 2.1.1. This affects the function Save of the file smart-sso-server/src/main/java/openjoe/smart/sso… |
CVE-2026-2971 | Medium | 4.3 | 2026-02-23 | A vulnerability was found in a466350665 Smart-SSO up to 2.1.1. Affected by this issue is some unknown functionality of the file smart-sso-server/src/main/resou… |
CVE-2026-2965 | Low | 2.4 | 2026-02-23 | A security flaw has been discovered in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.9. The affected element is an unknown function of the file /admin/SysModule/e… |
CVE-2026-2964 | Medium | 5.0 | 2026-02-23 | A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the compone… |
CVE-2026-2947 | Low | 3.5 | 2026-02-22 | A vulnerability was detected in rymcu forest up to 0.0.5. This affects the function updateUserInfo of the file - src/main/java/com/rymcu/forest/web/api/user/Us… |
CVE-2026-2946 | Low | 3.5 | 2026-02-22 | A security vulnerability has been detected in rymcu forest up to 0.0.5. Affected by this issue is the function XssUtils.replaceHtmlCode of the file src/main/ja… |
CVE-2026-2943 | Medium | 4.3 | 2026-02-22 | A vulnerability was identified in SapneshNaik Student Management System up to f4b4f0928f0b5551a28ee81ae7e7fe47d9345318. This impacts an unknown function of the… |
CVE-2026-2939 | Low | 2.4 | 2026-02-22 | A vulnerability was found in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /add_student/ of the component… |
CVE-2026-2934 | Low | 2.4 | 2026-02-22 | A security vulnerability has been detected in YiFang CMS up to 2.0.5. This impacts the function update of the file app/db/admin/D_friendLinkGroup.php of the co… |
CVE-2026-2933 | Low | 2.4 | 2026-02-22 | A weakness has been identified in YiFang CMS up to 2.0.5. This affects the function update of the file app/db/admin/D_adManage.php of the component Extended Ma… |
CVE-2026-2932 | Low | 2.4 | 2026-02-22 | A security flaw has been discovered in YiFang CMS up to 2.0.5. The impacted element is the function update of the file app/db/admin/D_adPosition.php of the com… |
CVE-2026-2897 | Low | 2.4 | 2026-02-22 | A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html o… |
CVE-2026-27574 | Critical | 9.9 | 2026-02-21 | OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm mod… |
CVE-2026-27464 | High | 7.7 | 2026-02-21 | Metabase is an open-source data analytics platform. In versions prior to 0.57.13 and versions 0.58.x through 0.58.6, authenticated users are able to retrieve s… |
CVE-2026-26045 | High | 7.2 | 2026-02-21 | A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicio… |
CVE-2025-15583 | Low | 3.5 | 2026-02-20 | A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipula… |
CVE-2025-67979 | Critical | 9.9 | 2026-02-20 | Improper Control of Generation of Code ('Code Injection') vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Code Injec… |
CVE-2025-52744 | High | 7.7 | 2026-02-20 | Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affe… |
CVE-2026-2825 | Low | 3.5 | 2026-02-20 | A vulnerability has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This impacts the function fix_html of the file tools/fix.py of the component Article Mo… |
CVE-2026-26030 | Critical | 9.9 | 2026-02-19 | Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemo… |
CVE-2025-71243 | Critical | 9.8 | 2026-02-19 | The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacke… |
CVE-2026-25755 | High | 8.1 | 2026-02-19 | jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PD… |
CVE-2026-24764 | Low | 3.7 | 2026-02-19 | OpenClaw (formerly Clawdbot) is a personal AI assistant users run on their own devices. In versions 2026.2.2 and below, when the Slack integration is enabled… |
CVE-2026-25548 | Critical | 9.1 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists… |
CVE-2026-27174 | Critical | 9.8 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/p… |
CVE-2025-14009 | High | 8.8 | 2026-02-18 | A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipf… |
CVE-2025-61982 | High | 7.8 | 2026-02-18 | An arbitrary code execution vulnerability exists in the Code Stream directive functionality of OpenCFD OpenFOAM 2506. A specially crafted OpenFOAM simulation f… |
CVE-2025-33251 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to co… |
CVE-2025-33250 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to co… |
CVE-2025-33240 | High | 7.8 | 2026-02-18 | NVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code injection. A successful exploit of this… |
CVE-2025-33239 | High | 7.8 | 2026-02-18 | NVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code injection. A successful exploit of this vu… |
CVE-2025-33236 | High | 7.8 | 2026-02-18 | NVIDIA NeMo Framework contains a vulnerability where malicious data created by an attacker could cause code injection. A successful exploit of this vulnerabili… |