CWE-94 · Code Injection (page 16)
Page 16 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11851 | Low | 3.5 | 2025-10-16 | A vulnerability has been found in Apeman ID71 EN75.8.53.20. The affected element is an unknown function of the file /set_alias.cgi. Such manipulation of the ar… |
CVE-2025-11548 | | 2025-10-14 | A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the application which may lead to unauthenti… | |
CVE-2025-31365 | Medium | 5.8 | 2025-10-14 | An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2.8 may allow an una… |
CVE-2025-46581 | Critical | 9.8 | 2025-10-14 | ZTE's ZXCDN product is affected by a Struts remote code execution (RCE) vulnerability. An unauthenticated attacker can remotely execute commands with non-root… |
CVE-2025-41699 | High | 8.8 | 2025-10-14 | An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resu… |
CVE-2025-42901 | Medium | 5.4 | 2025-10-14 | SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when a… |
CVE-2025-61929 | Critical | 9.6 | 2025-10-10 | Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called `cherrystudio://`. When handling t… |
CVE-2025-61927 | | 2025-10-10 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that… | |
CVE-2025-61773 | High | 8.1 | 2025-10-09 | pyLoad is a free and open-source download manager written in Python. In versions prior to 0.5.0b3.dev91, pyLoad web interface contained insufficient input vali… |
CVE-2025-11539 | Critical | 9.9 | 2025-10-09 | Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due to the fact that the /render/csv endpoi… |
CVE-2025-11512 | Medium | 4.3 | 2025-10-09 | A vulnerability was found in code-projects Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/voters_add.php. The manip… |
CVE-2025-11485 | Low | 2.4 | 2025-10-08 | A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function add_user of the file /admin.php of the componen… |
CVE-2025-11437 | Low | 2.4 | 2025-10-08 | A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation… |
CVE-2025-11435 | Medium | 4.3 | 2025-10-08 | A security vulnerability has been detected in JhumanJ OpnForm up to 1.9.3. Affected by this vulnerability is an unknown functionality of the file /show/submiss… |
CVE-2025-11433 | Low | 3.5 | 2025-10-08 | A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/employee/controller.php… |
CVE-2025-11425 | Low | 2.4 | 2025-10-08 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /edit_admin.php. The manipu… |
CVE-2025-11421 | Low | 3.5 | 2025-10-08 | A flaw has been found in code-projects Voting System 1.0. The affected element is an unknown function of the file /admin/candidates_edit.php. This manipulation… |
CVE-2025-11390 | Medium | 4.3 | 2025-10-07 | A weakness has been identified in PHPGurukul Cyber Cafe Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /search.p… |
CVE-2025-11360 | Medium | 4.3 | 2025-10-07 | A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component AP… |
CVE-2025-61774 | | 2025-10-06 | PyVista provides 3D plotting and mesh analysis through an interface for the Visualization Toolkit (VTK). Version 0.46.3 of the PyVista Project is vulnerable to… | |
CVE-2025-11344 | Medium | 6.3 | 2025-10-06 | A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Certificate Import Hand… |
CVE-2025-11333 | Low | 2.4 | 2025-10-06 | A vulnerability was identified in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. This impacts an unknown function of the file… |
CVE-2025-11332 | Low | 3.5 | 2025-10-06 | A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php of the component URL Handler. Executing… |
CVE-2025-11308 | Low | 3.5 | 2025-10-05 | A vulnerability was identified in Vanderlande Baggage 360 7.0.0. This issue affects some unknown processing of the file /api-addons/v1/messages. Such manipulat… |
CVE-2025-11306 | Medium | 4.3 | 2025-10-05 | A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulatio… |
CVE-2025-11291 | Medium | 4.3 | 2025-10-05 | A security flaw has been discovered in ixmaps website2017 up to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0. This impacts an unknown function of the file /map.php… |
CVE-2025-11289 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/… |
CVE-2025-11283 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument D… |
CVE-2025-11282 | Low | 2.4 | 2025-10-05 | A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a… |
CVE-2025-11278 | Medium | 4.3 | 2025-10-05 | A security vulnerability has been detected in AllStarLink Supermon up to 6.2. This vulnerability affects unknown code of the component AllMon2. The manipulatio… |
CVE-2025-11276 | Low | 3.5 | 2025-10-05 | A security flaw has been discovered in Rebuild up to 4.1.3. Affected by this issue is some unknown functionality of the component Comment/Guestbook. Performing… |
CVE-2025-54374 | High | 8.8 | 2025-10-03 | Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code execution vulnerability. An attacker c… |
CVE-2025-46818 | Medium | 6.0 | 2025-10-03 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script t… |
CVE-2025-61593 | High | 7.1 | 2025-10-03 | Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI Agent protects its sensitive files (i.e… |
CVE-2025-61590 | High | 7.5 | 2025-10-03 | Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution (RCE) attacks through Visual Studio Code… |
CVE-2025-59536 | High | 8.8 | 2025-10-03 | Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the startup trust dialog implementation. Claud… |
CVE-2025-61588 | | 2025-10-02 | RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-z… | |
CVE-2025-56588 | High | 8.8 | 2025-10-01 | Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field param… |
CVE-2025-11153 | High | 7.5 | 2025-09-30 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 143.0.3. |
CVE-2025-59954 | Critical | 9.8 | 2025-09-30 | Knowage is an open source analytics and business intelligence suite. Versions 8.1.26 and below are vulnerable to Remote Code Exection through using an unsafe o… |
CVE-2025-59952 | | 2025-09-30 | MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio… | |
CVE-2025-11137 | Low | 3.5 | 2025-09-29 | A vulnerability has been found in Gstarsoft GstarCAD up to 9.4.0. This affects an unknown function of the component File Renaming Handler. The manipulation lea… |
CVE-2025-11134 | Low | 2.4 | 2025-09-29 | A security vulnerability has been detected in Cudy TR1200 1.16.3-20230804-164635. Impacted is an unknown function of the file /cgi-bin/luci/admin/network/wirel… |
CVE-2025-11125 | Medium | 4.3 | 2025-09-29 | A vulnerability was found in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. Affected by this vulnerability is an unknown func… |
CVE-2025-11124 | Low | 3.5 | 2025-09-28 | A vulnerability has been found in code-projects Project Monitoring System 1.0. Affected is an unknown function of the file /onlineJobSearchEngine/postjob.php… |
CVE-2025-11119 | Medium | 4.3 | 2025-09-28 | A security flaw has been discovered in itsourcecode Hostel Management System 1.0. Impacted is an unknown function of the file /justines/index.php of the compon… |
CVE-2025-11112 | Medium | 4.3 | 2025-09-28 | A security vulnerability has been detected in PHPGurukul Employee Record Management System 1.3. This impacts an unknown function of the file /myprofile.php. Su… |
CVE-2025-11069 | Low | 2.4 | 2025-09-27 | A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save of the component Ad… |
CVE-2025-11068 | Low | 2.4 | 2025-09-27 | A vulnerability was found in westboy CicadasCMS 1.0. Affected by this vulnerability is an unknown functionality of the file /system/cms/category/save. The mani… |
CVE-2025-11067 | Low | 2.4 | 2025-09-27 | A vulnerability has been found in Projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /myform.php of the component Add Vis… |
CVE-2025-11027 | Low | 2.4 | 2025-09-26 | A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such mani… |
CVE-2025-11019 | Low | 2.4 | 2025-09-26 | A vulnerability has been found in Total.js CMS up to 19.9.0. This impacts an unknown function of the component Files Menu. The manipulation leads to cross site… |
CVE-2025-60114 | Medium | 6.6 | 2025-09-26 | Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurr… |
CVE-2025-10993 | Medium | 4.7 | 2025-09-26 | A security flaw has been discovered in MuYuCMS up to 2.7. Affected by this issue is some unknown functionality of the file /admin.php of the component Template… |
CVE-2025-59823 | Critical | 9.9 | 2025-09-25 | Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions f… |
CVE-2025-10949 | Low | 2.4 | 2025-09-25 | A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The ma… |
CVE-2025-10946 | Low | 3.5 | 2025-09-25 | A vulnerability was detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. The affected element is an unknown function of the file dy.php… |
CVE-2025-10945 | Low | 3.5 | 2025-09-25 | A security vulnerability has been detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. Impacted is an unknown function of the file d.php… |
CVE-2025-10944 | Low | 3.5 | 2025-09-25 | A weakness has been identified in yi-ge get-header-ip up to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. This issue affects the function ip of the file ip.php. Th… |
CVE-2025-10943 | Low | 3.5 | 2025-09-25 | A security flaw has been discovered in MikeCen WeChat-Face-Recognition up to 6e3f72bf8547d80b59e330f1137e4aa505f492c1. This vulnerability affects the function… |
CVE-2025-10940 | Low | 2.4 | 2025-09-25 | A vulnerability was found in Total.js CMS 1.0.0. Affected by this vulnerability is the function layouts_save of the file /admin/ of the component Layout Page… |
CVE-2025-59251 | High | 7.6 | 2025-09-24 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2025-10909 | Low | 2.4 | 2025-09-24 | A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Ha… |
CVE-2025-23354 | High | 7.8 | 2025-09-24 | NVIDIA Megatron-LM for all platforms contains a vulnerability in the ensemble_classifer script where malicious data created by an attacker may cause an injecti… |
CVE-2025-23353 | High | 7.8 | 2025-09-24 | NVIDIA Megatron-LM for all platforms contains a vulnerability in the msdp preprocessing script where malicious data created by an attacker may cause an injecti… |
CVE-2025-23349 | High | 7.8 | 2025-09-24 | NVIDIA Megatron-LM for all platforms contains a vulnerability in the tasks/orqa/unsupervised/nq.py component, where an attacker may cause a code injection. A s… |
CVE-2025-23348 | High | 7.8 | 2025-09-24 | NVIDIA Megatron-LM for all platforms contains a vulnerability in the pretrain_gpt script, where malicious data created by an attacker may cause a code injectio… |
CVE-2025-5717 | Medium | 6.8 | 2025-09-23 | An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin servi… |
CVE-2025-9321 | Critical | 9.8 | 2025-09-23 | The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and r… |
CVE-2025-10837 | Low | 3.5 | 2025-09-23 | A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-10827 | Medium | 4.3 | 2025-09-23 | A weakness has been identified in PHPJabbers Restaurant Menu Maker up to 1.1. Affected by this issue is some unknown functionality of the file /preview.php. Th… |
CVE-2025-59528 | Critical | 10.0 | 2025-09-22 | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The… |
CVE-2025-58673 | Medium | 5.4 | 2025-09-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend wp-user-frontend allows Code Injection.This issue affects WP… |
CVE-2025-57439 | High | 8.8 | 2025-09-22 | Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inje… |
CVE-2025-10794 | Medium | 4.3 | 2025-09-22 | A flaw has been found in PHPGurukul Car Rental Project 3.0. Affected by this issue is some unknown functionality of the file /carrental/search.php. Executing m… |
CVE-2025-10758 | Low | 2.4 | 2025-09-21 | A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the compone… |
CVE-2025-54815 | High | 8.8 | 2025-09-19 | Server-side template injection (SSTI) vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes. |
CVE-2025-57644 | Critical | 9.1 | 2025-09-19 | Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbit… |
CVE-2025-10711 | Medium | 4.3 | 2025-09-19 | A vulnerability has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This vulnerability affects unknown code of the file /index.php/sysmanage/Log… |
CVE-2025-10710 | Medium | 4.3 | 2025-09-19 | A flaw has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This affects an unknown part of the file /index.php. This manipulation of the argumen… |
CVE-2025-10642 | Low | 3.5 | 2025-09-18 | A vulnerability has been found in wangchenyi1996 chat_forum up to 80bdb92f5b460d36cab36e530a2c618acef5afd2. This impacts an unknown function of the file /q.php… |
CVE-2025-10632 | Low | 3.5 | 2025-09-18 | A security flaw has been discovered in itsourcecode Online Petshop Management System 1.0. The affected element is an unknown function of the file availablefram… |
CVE-2025-10631 | Low | 3.5 | 2025-09-18 | A vulnerability was identified in itsourcecode Online Petshop Management System 1.0. Impacted is an unknown function of the file addcnp.php of the component Av… |
CVE-2025-10614 | Medium | 4.3 | 2025-09-17 | A vulnerability was determined in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0 on COVID. This affects an unknown function of the file… |
CVE-2025-58766 | Critical | 9.0 | 2025-09-17 | Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and earlier versions that allows attackers to… |
CVE-2025-10606 | Medium | 4.3 | 2025-09-17 | A weakness has been identified in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/Configuracao/ConfiguracaoMovim… |
CVE-2025-10605 | Medium | 4.3 | 2025-09-17 | A security flaw has been discovered in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /agenda_preferencias.php. The manipu… |
CVE-2025-10591 | Low | 3.5 | 2025-09-17 | A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_funcao_cad.php of the component… |
CVE-2025-10590 | Medium | 4.3 | 2025-09-17 | A security flaw has been discovered in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_usuario_det.php… |
CVE-2025-10057 | High | 8.8 | 2025-09-17 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28… |
CVE-2025-10584 | Low | 3.5 | 2025-09-17 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Suc… |
CVE-2025-10566 | Medium | 4.3 | 2025-09-16 | A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /index.php… |
CVE-2025-41243 | Critical | 10.0 | 2025-09-16 | Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the… |
CVE-2025-10485 | Medium | 4.3 | 2025-09-15 | A vulnerability has been found in pojoin h3blog up to 5bf704425ebc11f4c24da51f32f36bb17ae20489. Affected by this issue is the function ppt_log of the file /log… |
CVE-2025-10434 | Low | 2.4 | 2025-09-15 | A vulnerability was identified in IbuyuCMS up to 2.6.3. Impacted is an unknown function of the file /admin/article.php?a=mod of the component Add Article Page… |
CVE-2025-10411 | Medium | 4.3 | 2025-09-14 | A vulnerability was detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /… |
CVE-2025-10394 | Medium | 4.7 | 2025-09-14 | A vulnerability has been found in fcba_zzm ics-park Smart Park Management System 2.0. Affected is an unknown function of the file ruoyi-quartz/src/main/java/co… |
CVE-2025-10388 | Low | 3.5 | 2025-09-14 | A vulnerability was identified in Selleo Mentingo 2025.08.27. This issue affects some unknown processing of the file /api/course/enroll-course of the component… |
CVE-2025-10386 | Medium | 4.3 | 2025-09-14 | A vulnerability was found in Yida ECMS Consulting Enterprise Management System 1.0. This affects an unknown part of the file /login.do of the component POST Re… |
CVE-2025-10373 | Low | 3.5 | 2025-09-13 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /intranet/educar_turma_ti… |