CWE-94 · Code Injection (page 14)
Page 14 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14991 | Low | 2.4 | 2025-12-21 | A weakness has been identified in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin… |
CVE-2025-14962 | Medium | 4.3 | 2025-12-19 | A flaw has been found in code-projects Simple Stock System 1.0. The impacted element is an unknown function of the file /market/chatuser.php. This manipulation… |
CVE-2025-66580 | Critical | 9.6 | 2025-12-19 | Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting (XSS) vulnerabi… |
CVE-2025-63665 | Critical | 9.8 | 2025-12-19 | An issue in GT Edge AI Community Edition Versions before v2.0.12 allows attackers to execute arbitrary code via injecting a crafted JSON payload into the Promp… |
CVE-2025-34433 | | 2025-12-19 | AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt us… | |
CVE-2025-65037 | Critical | 10.0 | 2025-12-18 | Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network. |
CVE-2025-64676 | High | 7.2 | 2025-12-18 | '.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network. |
CVE-2023-53940 | High | 7.8 | 2025-12-18 | Codigo Markdown Editor 1.0.1 contains a code execution vulnerability that allows attackers to run arbitrary system commands by crafting a malicious markdown fi… |
CVE-2025-68278 | High | 8.8 | 2025-12-18 | Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers tha… |
CVE-2025-66078 | Critical | 9.1 | 2025-12-18 | Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclu… |
CVE-2025-60070 | Medium | 6.5 | 2025-12-18 | Improper Control of Generation of Code ('Code Injection') vulnerability in The4 Molla molla allows Code Injection.This issue affects Molla: from n/a through <=… |
CVE-2025-60068 | Medium | 6.5 | 2025-12-18 | Improper Control of Generation of Code ('Code Injection') vulnerability in javothemes Javo Core javo-core allows Code Injection.This issue affects Javo Core: f… |
CVE-2025-14856 | Medium | 6.3 | 2025-12-18 | A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Suc… |
CVE-2025-14837 | Medium | 4.7 | 2025-12-18 | A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Websit… |
CVE-2025-62521 | Critical | 10.0 | 2025-12-17 | ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wi… |
CVE-2025-67172 | High | 7.2 | 2025-12-17 | RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function. |
CVE-2025-67164 | Critical | 9.9 | 2025-12-17 | An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via up… |
CVE-2025-14801 | Low | 2.4 | 2025-12-17 | A security vulnerability has been detected in xiweicheng TMS up to 2.28.0. This affects the function createComment of the file /admin/blog/comment/create. Such… |
CVE-2025-46295 | Critical | 9.8 | 2025-12-16 | Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substi… |
CVE-2025-37164 | Critical | 10.0 | 2025-12-16 | A remote code execution issue exists in HPE OneView. |
CVE-2025-67748 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module… |
CVE-2025-67744 | Critical | 9.6 | 2025-12-16 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exis… |
CVE-2025-14730 | Medium | 4.7 | 2025-12-15 | A security flaw has been discovered in CTCMS Content Management System up to 2.1.2. The impacted element is an unknown function in the library /ctcms/libs/Ct_C… |
CVE-2025-14729 | Medium | 4.7 | 2025-12-15 | A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of… |
CVE-2025-14722 | Low | 2.4 | 2025-12-15 | A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/Ad… |
CVE-2023-53888 | High | 8.8 | 2025-12-15 | Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulati… |
CVE-2023-53883 | High | 7.2 | 2025-12-15 | Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation… |
CVE-2025-66438 | High | 8.8 | 2025-12-15 | A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frap… |
CVE-2025-66437 | High | 8.8 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders addres… |
CVE-2025-66436 | Medium | 4.3 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders at… |
CVE-2025-66435 | Medium | 4.3 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attac… |
CVE-2025-66434 | High | 8.8 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders att… |
CVE-2025-14691 | Medium | 4.3 | 2025-12-14 | A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in… |
CVE-2025-14663 | Low | 2.4 | 2025-12-14 | A vulnerability was determined in code-projects Student File Management System 1.0. This vulnerability affects unknown code of the file /admin/update_student.p… |
CVE-2025-14662 | Low | 2.4 | 2025-12-14 | A vulnerability was found in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/update_user.php of the component… |
CVE-2025-14539 | Medium | 5.4 | 2025-12-13 | The The Shortcode Ajax plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the softwa… |
CVE-2025-67750 | High | 8.4 | 2025-12-12 | Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of Salesforce Flows. Versions 6.10.5 and belo… |
CVE-2025-14580 | Low | 3.5 | 2025-12-12 | A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/bi… |
CVE-2025-65854 | Critical | 9.8 | 2025-12-12 | Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover. |
CVE-2025-12843 | Medium | 5.5 | 2025-12-12 | Code Injection using Electron Fuses in waveterm on MacOS allows TCC Bypass. This issue affects waveterm: 0.12.2. |
CVE-2025-67727 | Critical | 9.8 | 2025-12-12 | Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow i… |
CVE-2025-14166 | Medium | 5.3 | 2025-12-12 | The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing A… |
CVE-2025-14538 | Low | 3.5 | 2025-12-11 | A security vulnerability has been detected in yangshare warehouseManager 仓库管理系统 1.1.0. This affects the function addCustomer of the file CustomerManageHandler… |
CVE-2025-13780 | Critical | 9.1 | 2025-12-11 | pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PL… |
CVE-2025-55313 | High | 7.8 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. They allow potential arbitrary code execution when pr… |
CVE-2025-14519 | Low | 3.5 | 2025-12-11 | A security flaw has been discovered in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. This issue affects some unknown processing of the file /admi… |
CVE-2025-67509 | High | 8.2 | 2025-12-10 | Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. My… |
CVE-2025-66474 | High | 8.8 | 2025-12-10 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions… |
CVE-2025-65294 | Critical | 9.8 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestr… |
CVE-2024-58284 | High | 7.2 | 2025-12-10 | PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the meta… |
CVE-2025-65829 | Medium | 6.8 | 2025-12-10 | The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures that only authentic… |
CVE-2025-65602 | Critical | 9.8 | 2025-12-10 | A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-67489 | Critical | 9.8 | 2025-12-09 | @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the de… |
CVE-2025-66457 | High | 8.8 | 2025-12-09 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are s… |
CVE-2025-66533 | Medium | 5.3 | 2025-12-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a thro… |
CVE-2025-42880 | Critical | 9.9 | 2025-12-09 | Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module… |
CVE-2025-14324 | Critical | 9.8 | 2025-12-09 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146… |
CVE-2025-13642 | Medium | 5.4 | 2025-12-09 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2025-66481 | Critical | 9.6 | 2025-12-09 | DeepChat is an open-source AI chat platform that supports cloud models and LLMs. Versions 0.5.1 and below are vulnerable to XSS attacks through improperly sani… |
CVE-2025-65271 | High | 8.8 | 2025-12-08 | Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an admini… |
CVE-2025-14244 | Low | 2.4 | 2025-12-08 | A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomController.class.php of th… |
CVE-2025-14228 | Low | 3.5 | 2025-12-08 | A weakness has been identified in Yealink SIP-T21P E2 52.84.0.15. Impacted is an unknown function of the component Local Directory Page. This manipulation caus… |
CVE-2025-14221 | Low | 3.5 | 2025-12-08 | A vulnerability was detected in SourceCodester Online Banking System 1.0. This impacts an unknown function of the file /?page=user. The manipulation of the arg… |
CVE-2025-14205 | Low | 2.4 | 2025-12-08 | A vulnerability was found in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is an unknown function of the file /membership_profil… |
CVE-2025-14201 | Low | 2.4 | 2025-12-07 | A vulnerability was found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected by this vulnera… |
CVE-2025-14200 | Low | 3.5 | 2025-12-07 | A vulnerability has been found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected is an unkn… |
CVE-2025-14194 | Low | 3.5 | 2025-12-07 | A vulnerability was identified in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file /view_personnel… |
CVE-2025-66562 | Critical | 9.6 | 2025-12-05 | TUUI is a desktop MCP client designed as a tool unitary utility integration. Prior to 1.3.4, a critical Remote Code Execution (RCE) vulnerability exists in Tuu… |
CVE-2025-14013 | Low | 2.4 | 2025-12-04 | A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.php/admins/Comment/addcomment.html of th… |
CVE-2025-14007 | Low | 2.0 | 2025-12-04 | A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1. This affects an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile of the c… |
CVE-2025-14006 | Low | 3.5 | 2025-12-04 | A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1. Affected by this issue is some unknown functionality of the file /admind45f74adbd95… |
CVE-2025-14005 | Low | 2.4 | 2025-12-04 | A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. Affected by this vulnerability is an unknown functionality of the file /admind45f74adbd95.php?c… |
CVE-2025-66222 | Critical | 9.6 | 2025-12-03 | DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid dia… |
CVE-2024-32641 | Critical | 9.8 | 2025-12-03 | Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution… |
CVE-2025-13486 | Critical | 9.8 | 2025-12-03 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() fun… |
CVE-2025-13658 | | 2025-12-02 | A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code sig… | |
CVE-2025-66448 | High | 7.1 | 2025-12-01 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class n… |
CVE-2025-66299 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user… |
CVE-2025-66294 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attac… |
CVE-2024-39148 | High | 8.1 | 2025-12-01 | The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS… |
CVE-2025-13802 | Medium | 4.3 | 2025-12-01 | A vulnerability was determined in jairiidriss RestaurantWebsite up to e7911f12d035e8e2f9a75e7a28b59e4ef5c1d654. Impacted is an unknown function of the componen… |
CVE-2025-13795 | Low | 2.4 | 2025-11-30 | A weakness has been identified in codingWithElias School Management System up to f1ac334bfd89ae9067cc14dea12ec6ff3f078c01. Affected is an unknown function of t… |
CVE-2025-13793 | Medium | 4.3 | 2025-11-30 | A weakness has been identified in winston-dsouza Ecommerce-Website up to 87734c043269baac0b4cfe9664784462138b1b2e. Affected by this issue is some unknown funct… |
CVE-2025-13792 | High | 7.3 | 2025-11-30 | A security flaw has been discovered in Qualitor up to 8.20.104/8.24.97. Affected by this vulnerability is the function eval of the file /html/st/stdeslocamento… |
CVE-2025-13786 | High | 7.3 | 2025-11-30 | A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing… |
CVE-2025-13784 | Low | 2.4 | 2025-11-30 | A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1… |
CVE-2025-66224 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail… |
CVE-2025-59302 | Medium | 4.7 | 2025-11-27 | In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admin… |
CVE-2025-62593 | High | 8.8 | 2025-11-26 | Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability explo… |
CVE-2025-33204 | High | 7.8 | 2025-11-25 | NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components, where malicious data created by an attacker could cause code in… |
CVE-2025-64050 | High | 7.2 | 2025-11-25 | A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arb… |
CVE-2025-6389 | Critical | 9.8 | 2025-11-25 | The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_c… |
CVE-2025-13584 | Low | 3.5 | 2025-11-24 | A security vulnerability has been detected in Eigenfocus up to 1.4.0. This vulnerability affects unknown code of the component Description Handler. The manipul… |
CVE-2025-13577 | Low | 3.5 | 2025-11-24 | A flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php. Executing a… |
CVE-2025-65108 | Critical | 10.0 | 2025-11-21 | md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that cont… |
CVE-2025-13484 | Low | 2.4 | 2025-11-20 | A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/cus… |
CVE-2025-12120 | High | 7.3 | 2025-11-20 | Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation… |
CVE-2025-13469 | Low | 2.4 | 2025-11-20 | A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/payme… |
CVE-2025-13450 | Low | 3.5 | 2025-11-20 | A vulnerability was determined in SourceCodester Online Shop Project 1.0. Impacted is an unknown function of the file /shop/register.php. This manipulation of… |
CVE-2025-13415 | Low | 3.5 | 2025-11-19 | A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. Th… |