CWE-94 · Code Injection (page 15)
Page 15 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13412 | Low | 2.4 | 2025-11-19 | A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/ad… |
CVE-2025-65099 | Critical | 9.8 | 2025-11-19 | Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execut… |
CVE-2025-65026 | Medium | 6.1 | 2025-11-19 | esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injectio… |
CVE-2025-10703 | | 2025-11-19 | Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC d… | |
CVE-2025-10702 | | 2025-11-19 | Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC d… | |
CVE-2025-13035 | High | 8.0 | 2025-11-19 | The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the plugin's use of extr… |
CVE-2025-63693 | Medium | 5.4 | 2025-11-18 | The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple co… |
CVE-2025-37157 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-33184 | High | 7.8 | 2025-11-18 | NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue. A successful exploit… |
CVE-2025-33183 | High | 7.8 | 2025-11-18 | NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue. A successful exploit… |
CVE-2025-13349 | Low | 3.5 | 2025-11-18 | A vulnerability has been found in SourceCodester Student Grades Management System 1.0. This issue affects some unknown processing of the file /grades.php of th… |
CVE-2025-13343 | Low | 3.5 | 2025-11-18 | A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuestion.php. The manip… |
CVE-2025-7711 | Medium | 5.4 | 2025-11-17 | The The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up… |
CVE-2025-13245 | Low | 3.5 | 2025-11-16 | A vulnerability was identified in code-projects Student Information System 2.0. The impacted element is an unknown function of the file /editprofile.php. Such… |
CVE-2025-13244 | Medium | 4.3 | 2025-11-16 | A vulnerability was determined in code-projects Student Information System 2.0. The affected element is an unknown function of the file /register.php. This man… |
CVE-2025-13232 | Low | 3.5 | 2025-11-16 | A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation cause… |
CVE-2025-13202 | Low | 3.5 | 2025-11-15 | A security flaw has been discovered in code-projects Simple Cafe Ordering System 1.0. This affects an unknown part of the file /add_to_cart. Performing manipul… |
CVE-2025-13186 | Low | 2.4 | 2025-11-14 | A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. This impacts an unknown function of the file… |
CVE-2025-13182 | Low | 3.5 | 2025-11-14 | A vulnerability was identified in pojoin h3blog 1.0. The impacted element is an unknown function of the file /admin/cms/category/addtitle. The manipulation of… |
CVE-2025-13181 | Low | 3.5 | 2025-11-14 | A vulnerability was determined in pojoin h3blog 1.0. The affected element is an unknown function of the file /admin/cms/material/add. Executing a manipulation… |
CVE-2025-12762 | Critical | 9.1 | 2025-11-13 | pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLA… |
CVE-2025-12733 | High | 8.8 | 2025-11-13 | The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and inclu… |
CVE-2025-13058 | Low | 3.5 | 2025-11-12 | A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The mani… |
CVE-2024-48829 | Medium | 6.7 | 2025-11-12 | Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileg… |
CVE-2025-33178 | High | 7.8 | 2025-11-11 | NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code in… |
CVE-2025-23361 | High | 7.8 | 2025-11-11 | NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code g… |
CVE-2025-23357 | High | 7.8 | 2025-11-11 | NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A succ… |
CVE-2025-12813 | Critical | 9.8 | 2025-11-11 | The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parame… |
CVE-2025-12637 | High | 8.8 | 2025-11-11 | The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the process_theme function in… |
CVE-2025-42895 | Medium | 6.9 | 2025-11-11 | Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally authenticated user to supply crafted par… |
CVE-2025-42887 | Critical | 9.9 | 2025-11-11 | Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module… |
CVE-2025-12920 | Low | 2.4 | 2025-11-09 | A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. Thi… |
CVE-2025-9334 | High | 8.8 | 2025-11-08 | The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7… |
CVE-2020-36870 | | 2025-11-07 | Various Ruijie Gateway EG and NBR models firmware versions 11.1(6)B9P1 < 11.9(4)B12P1 contain a code execution vulnerability in the EWEB management system that… | |
CVE-2025-49372 | Critical | 10.0 | 2025-11-06 | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Remote Code Inclusion.T… |
CVE-2025-47588 | Critical | 9.1 | 2025-11-06 | Improper Control of Generation of Code ('Code Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing… |
CVE-2025-32222 | Critical | 9.9 | 2025-11-06 | Improper Control of Generation of Code ('Code Injection') vulnerability in Widgetlogic.org Widget Logic widget-logic allows Code Injection.This issue affects W… |
CVE-2025-11093 | High | 8.4 | 2025-11-05 | An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engine… |
CVE-2025-12735 | Critical | 9.8 | 2025-11-05 | The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However… |
CVE-2025-64108 | High | 8.8 | 2025-11-04 | Cursor is a code editor built for programming with AI. In versions 1.7.44 and below, various NTFS path quirks allow a prompt injection attacker to circumvent s… |
CVE-2025-62369 | High | 7.2 | 2025-11-04 | Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerabil… |
CVE-2025-64321 | Medium | 5.3 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration File… |
CVE-2025-64320 | Medium | 6.5 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentfo… |
CVE-2025-64318 | Medium | 5.3 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration… |
CVE-2025-10875 | Medium | 6.5 | 2025-11-04 | Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Code Injection.This issue affects Mul… |
CVE-2025-60785 | High | 8.8 | 2025-11-03 | A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via a cr… |
CVE-2025-6990 | High | 8.8 | 2025-11-01 | The kallyas theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.0 via the `TH_PhpCode` pagebuilder widget. T… |
CVE-2025-10487 | High | 7.3 | 2025-11-01 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select… |
CVE-2025-12546 | Low | 3.5 | 2025-10-31 | A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulatio… |
CVE-2025-48984 | High | 8.8 | 2025-10-31 | A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. |
CVE-2025-34277 | Critical | 9.8 | 2025-10-30 | Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before bei… |
CVE-2025-61196 | High | 8.8 | 2025-10-30 | An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter. |
CVE-2025-50739 | Critical | 9.8 | 2025-10-30 | iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization. |
CVE-2025-56399 | High | 8.8 | 2025-10-28 | alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted file upload. A file w… |
CVE-2025-12335 | Medium | 4.3 | 2025-10-28 | A vulnerability was determined in code-projects E-Commerce Website 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/supplier_… |
CVE-2025-12332 | Low | 2.4 | 2025-10-28 | A flaw has been found in SourceCodester Student Grades Management System 1.0. This affects the function delete_user of the file /admin.php. Executing manipulat… |
CVE-2025-12334 | Medium | 4.3 | 2025-10-27 | A vulnerability was found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the… |
CVE-2025-12333 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/supplier_add.php. The manipulation… |
CVE-2025-12330 | Low | 2.4 | 2025-10-27 | A security flaw has been discovered in Willow CMS up to 1.4.0. This issue affects some unknown processing of the file /admin/articles/add of the component Add… |
CVE-2025-12312 | Low | 2.4 | 2025-10-27 | A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. Impacted is an unknown function of the file view-pass-detail.php. This manipulation of… |
CVE-2025-12311 | Low | 2.4 | 2025-10-27 | A vulnerability was detected in PHPGurukul Curfew e-Pass Management System 1.0. This issue affects some unknown processing of the file edit-category-detail.php… |
CVE-2025-12303 | Low | 2.4 | 2025-10-27 | A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0. The impacted element is an unknown function of the file admin-profile.php. Executing a… |
CVE-2025-12302 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in code-projects Simple Food Ordering System 1.0. The affected element is an unknown function of the file /editproduct.php. Perfor… |
CVE-2025-12300 | Medium | 4.3 | 2025-10-27 | A weakness has been identified in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addcategory.php. This… |
CVE-2025-12299 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /addproduct.php. The… |
CVE-2025-12298 | Medium | 4.3 | 2025-10-27 | A vulnerability was identified in code-projects Simple Food Ordering System 1.0. This affects an unknown part of the file /editcategory.php. The manipulation o… |
CVE-2025-12290 | Medium | 4.3 | 2025-10-27 | A vulnerability has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this issue is some u… |
CVE-2025-12289 | Medium | 4.3 | 2025-10-27 | A flaw has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0. Affected by this vulnerability is an unkn… |
CVE-2025-12282 | Low | 2.4 | 2025-10-27 | A vulnerability was identified in code-projects Client Details System 1.0. The affected element is an unknown function of the file /admin/manage-users.php. The… |
CVE-2025-12281 | Low | 2.4 | 2025-10-27 | A vulnerability was determined in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/clientview.php. Executing manipul… |
CVE-2025-12280 | Low | 2.4 | 2025-10-27 | A vulnerability was found in code-projects Client Details System 1.0. This issue affects some unknown processing of the file /update-clients.php. Performing ma… |
CVE-2025-12279 | Low | 2.4 | 2025-10-27 | A vulnerability has been found in code-projects Client Details System 1.0. This vulnerability affects unknown code of the file /welcome.php. Such manipulation… |
CVE-2025-12269 | Low | 3.5 | 2025-10-27 | A vulnerability was found in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The affected element is an unknown function of the file /dash/org/setti… |
CVE-2025-12267 | Medium | 4.3 | 2025-10-27 | A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argumen… |
CVE-2025-12266 | Medium | 6.3 | 2025-10-27 | A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to 20251009. This vulnerability affects the function _empty o… |
CVE-2025-12264 | Low | 3.5 | 2025-10-27 | A security flaw has been discovered in Wisencode up to 20251012. Affected by this vulnerability is an unknown functionality of the file /support-ticket/create… |
CVE-2025-12251 | Low | 3.5 | 2025-10-27 | A vulnerability has been found in OpenWGA 7.11.12 Build 737. This impacts an unknown function of the component Admin UI. The manipulation leads to cross site s… |
CVE-2025-12246 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in chatwoot up to 4.7.0. This issue affects some unknown processing of the file app/javascript/shared/components/IframeLoad… |
CVE-2025-12244 | Medium | 4.3 | 2025-10-27 | A vulnerability was determined in code-projects Simple E-Banking System 1.0. This affects an unknown part of the file /eBank/register.php. Executing manipulati… |
CVE-2025-12231 | Low | 2.4 | 2025-10-27 | A security vulnerability has been detected in projectworlds Expense Management System 1.0. Affected is an unknown function of the file /public/admin/expense_ca… |
CVE-2025-12230 | Low | 2.4 | 2025-10-27 | A weakness has been identified in projectworlds Expense Management System 1.0. This impacts an unknown function of the file /public/admin/currencies/create of… |
CVE-2025-12229 | Low | 2.4 | 2025-10-27 | A security flaw has been discovered in projectworlds Expense Management System 1.0. This affects an unknown function of the file /public/admin/roles/create of… |
CVE-2025-12228 | Low | 2.4 | 2025-10-27 | A vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/crea… |
CVE-2025-12227 | Low | 3.5 | 2025-10-27 | A vulnerability was determined in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. Executi… |
CVE-2025-12224 | Low | 3.5 | 2025-10-27 | A flaw has been found in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This vulnerability affects unknown code of the file adm… |
CVE-2025-62959 | Critical | 9.1 | 2025-10-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Remote Code Inclusi… |
CVE-2025-8483 | Medium | 6.3 | 2025-10-25 | The The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.5… |
CVE-2025-61136 | High | 7.1 | 2025-10-23 | A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning… |
CVE-2025-62023 | Critical | 9.0 | 2025-10-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through <=… |
CVE-2025-60206 | Critical | 10.0 | 2025-10-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a th… |
CVE-2025-52756 | High | 7.4 | 2025-10-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Sayan Datta WP Last Modified Info wp-last-modified-info allows Remote Code Inclusion… |
CVE-2025-49926 | High | 7.2 | 2025-10-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Laborator Kalium kalium allows Code Injection.This issue affects Kalium: from n/a th… |
CVE-2025-8848 | Medium | 5.4 | 2025-10-22 | A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET reques… |
CVE-2025-61488 | High | 7.6 | 2025-10-20 | An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and… |
CVE-2025-62429 | High | 7.2 | 2025-10-20 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/ad… |
CVE-2025-11946 | Low | 3.5 | 2025-10-19 | A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the co… |
CVE-2025-11945 | Low | 3.5 | 2025-10-19 | A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such… |
CVE-2025-57567 | Critical | 9.1 | 2025-10-17 | A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme director… |
CVE-2025-11905 | Medium | 6.3 | 2025-10-17 | A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2. This vulnerability affects the function getArticle of the file app\modules\cms\controller\gather… |
CVE-2025-62416 | Medium | 5.1 | 2025-10-16 | Bagisto is an open source laravel eCommerce platform. Bagisto v2.3.7 is vulnerable to Server-Side Template Injection (SSTI) due to unsanitized user input being… |