CWE-94 · Code Injection (page 18)
Page 18 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9647 | Medium | 4.3 | 2025-08-29 | A weakness has been identified in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/role/list. This manipulation of the ar… |
CVE-2025-9646 | Low | 3.5 | 2025-08-29 | A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_organization_assemble_personal/jaxrs/definit… |
CVE-2025-9595 | Medium | 4.3 | 2025-08-29 | A vulnerability was found in code-projects Student Information Management System 1.0. The impacted element is an unknown function of the file /login.php. The m… |
CVE-2025-9591 | Low | 2.4 | 2025-08-28 | A security vulnerability has been detected in ZrLog up to 3.1.5. This vulnerability affects unknown code of the file /api/admin/template/config of the componen… |
CVE-2025-9590 | Low | 3.5 | 2025-08-28 | A vulnerability was identified in Weaver E-Mobile Mobile Management Platform up to 20250813. Affected by this vulnerability is an unknown functionality. The ma… |
CVE-2024-48908 | | 2025-08-28 | lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code… | |
CVE-2025-54731 | High | 8.1 | 2025-08-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue… |
CVE-2025-48100 | Critical | 9.1 | 2025-08-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inc… |
CVE-2025-5101 | Medium | 5.0 | 2025-08-27 | An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that under certain conditions cou… |
CVE-2024-37777 | High | 8.8 | 2025-08-27 | O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function. |
CVE-2025-34159 | High | 8.8 | 2025-08-27 | Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows… |
CVE-2025-52122 | Critical | 9.8 | 2025-08-27 | Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection… |
CVE-2025-30057 | | 2025-08-27 | In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function. | |
CVE-2025-30056 | | 2025-08-27 | The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system. | |
CVE-2025-30055 | | 2025-08-27 | The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as… | |
CVE-2025-2313 | | 2025-08-27 | In the Print.pl service, the "uhcPrintServerPrint" function allows execution of arbitrary code via the "CopyCounter" parameter. | |
CVE-2025-23315 | High | 7.8 | 2025-08-26 | NVIDIA NeMo Framework for all platforms contains a vulnerability in the export and deploy component, where malicious data created by an attacker could cause a… |
CVE-2025-23314 | High | 7.8 | 2025-08-26 | NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP component, where malicious data created by an attacker could cause a code injection… |
CVE-2025-23313 | High | 7.8 | 2025-08-26 | NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP component, where malicious data created by an attacker could cause a code injection… |
CVE-2025-23312 | High | 7.8 | 2025-08-26 | NVIDIA NeMo Framework for all platforms contains a vulnerability in the retrieval services component, where malicious data created by an attacker could cause a… |
CVE-2025-23307 | High | 7.8 | 2025-08-26 | NVIDIA NeMo Curator for all platforms contains a vulnerability where a malicious file created by an attacker could allow code injection. A successful exploit o… |
CVE-2025-52218 | High | 7.5 | 2025-08-26 | SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection. Improper sanitization of unspecified parameters allo… |
CVE-2025-53419 | High | 7.8 | 2025-08-26 | Delta Electronics COMMGR has Code Injection vulnerability. |
CVE-2025-9440 | Medium | 4.3 | 2025-08-26 | A security vulnerability has been detected in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this issue is some unknown f… |
CVE-2025-9439 | Medium | 4.3 | 2025-08-26 | A weakness has been identified in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2025-9438 | Medium | 4.3 | 2025-08-26 | A security flaw has been discovered in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-9434 | Medium | 4.3 | 2025-08-26 | A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0. This affects an unknown function of the file /admin/… |
CVE-2025-9433 | Medium | 4.3 | 2025-08-26 | A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the component Admin Panel. Pe… |
CVE-2025-9432 | Medium | 4.3 | 2025-08-26 | A vulnerability has been found in mtons mblog up to 3.5.0. The affected element is an unknown function of the file /admin/post/list of the component Admin Pane… |
CVE-2025-9431 | Medium | 4.3 | 2025-08-26 | A flaw has been found in mtons mblog up to 3.5.0. Impacted is an unknown function of the file /search. This manipulation of the argument kw causes cross site s… |
CVE-2025-9430 | Low | 2.4 | 2025-08-26 | A vulnerability was detected in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/options/update. The manipulation of the… |
CVE-2025-9429 | Low | 3.5 | 2025-08-26 | A security vulnerability has been detected in mtons mblog up to 3.5.0. This vulnerability affects unknown code of the file /post/submit of the component Post H… |
CVE-2025-9422 | Low | 2.4 | 2025-08-25 | A vulnerability was found in oitcode samarium up to 0.9.6. This impacts an unknown function of the file /dashboard/team of the component Team Image Handler. Th… |
CVE-2025-9416 | Low | 2.4 | 2025-08-25 | A security flaw has been discovered in oitcode samarium up to 0.9.6. This vulnerability affects unknown code of the file /cms/webpage/ of the component Pages I… |
CVE-2025-57773 | Critical | 9.8 | 2025-08-25 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injecti… |
CVE-2025-57772 | Critical | 9.8 | 2025-08-25 | DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC… |
CVE-2025-9407 | Low | 3.5 | 2025-08-25 | A flaw has been found in mtons mblog up to 3.5.0. Affected by this vulnerability is an unknown functionality of the file /settings/profile. Executing manipulat… |
CVE-2025-9404 | Low | 2.4 | 2025-08-25 | A vulnerability was identified in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file /pointHierarchySLTS of the component Folder… |
CVE-2025-9388 | Low | 3.5 | 2025-08-24 | A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function of the file watch_list.shtm. Executing manipulation of the argument… |
CVE-2022-31491 | Critical | 10.0 | 2025-08-22 | Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbit… |
CVE-2024-52786 | Critical | 9.8 | 2025-08-22 | An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL. |
CVE-2010-20120 | | 2025-08-21 | Maple versions up to and including 13's Maplet framework allows embedded commands to be executed automatically when a .maplet file is opened. This behavior byp… | |
CVE-2025-9306 | Low | 3.5 | 2025-08-21 | A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/notice… |
CVE-2025-9237 | Low | 3.5 | 2025-08-20 | A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/my_account.php?edit_account of the compone… |
CVE-2025-9235 | Low | 3.5 | 2025-08-20 | A flaw has been found in Scada-LTS up to 2.7.8.1. The impacted element is an unknown function of the file compound_events.shtm. This manipulation of the argume… |
CVE-2025-9234 | Low | 3.5 | 2025-08-20 | A vulnerability was detected in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file maintenance_events.shtm. The manipulation of t… |
CVE-2025-9233 | Low | 3.5 | 2025-08-20 | A security vulnerability has been detected in Scada-LTS up to 2.7.8.1. Impacted is an unknown function of the file view_edit.shtm. The manipulation of the argu… |
CVE-2025-51991 | High | 8.8 | 2025-08-20 | XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info fie… |
CVE-2025-54019 | Medium | 6.5 | 2025-08-20 | Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a th… |
CVE-2025-53577 | Critical | 10.0 | 2025-08-20 | Improper Control of Generation of Code ('Code Injection') vulnerability in thehp Global DNS global-dns allows Remote Code Inclusion.This issue affects Global D… |
CVE-2025-48169 | Critical | 9.9 | 2025-08-20 | Improper Control of Generation of Code ('Code Injection') vulnerability in Jordy Meow Code Engine code-engine allows Remote Code Inclusion.This issue affects C… |
CVE-2025-30975 | High | 7.5 | 2025-08-20 | Improper Control of Generation of Code ('Code Injection') vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Code Injection.This issue affects… |
CVE-2025-9171 | Low | 3.5 | 2025-08-19 | A security flaw has been discovered in SolidInvoice up to 2.4.0. The impacted element is an unknown function of the file /clients of the component Clients Modu… |
CVE-2025-9170 | Low | 3.5 | 2025-08-19 | A vulnerability was identified in SolidInvoice up to 2.4.0. The affected element is an unknown function of the file /tax/rates of the component Tax Rates Modul… |
CVE-2025-9169 | Low | 3.5 | 2025-08-19 | A vulnerability was determined in SolidInvoice up to 2.4.0. Impacted is an unknown function of the file /quotes of the component Quote Module. This manipulatio… |
CVE-2025-9168 | Low | 3.5 | 2025-08-19 | A vulnerability was found in SolidInvoice up to 2.4.0. This issue affects some unknown processing of the file /invoice of the component Invoice Creation Module… |
CVE-2025-9167 | Low | 3.5 | 2025-08-19 | A vulnerability has been found in SolidInvoice up to 2.4.0. This vulnerability affects unknown code of the file /invoice/recurring of the component Recurring I… |
CVE-2025-55733 | Critical | 9.6 | 2025-08-19 | DeepChat is a smart assistant that connects powerful AI to your personal world. DeepChat before 0.3.1 has a one-click remote code execution vulnerability. An… |
CVE-2025-9147 | Low | 3.5 | 2025-08-19 | A vulnerability has been found in jasonclark getsemantic up to 040c96eb8cf9947488bd01b8de99b607b0519f7d. The impacted element is an unknown function of the fil… |
CVE-2025-9145 | Low | 3.5 | 2025-08-19 | A security vulnerability has been detected in Scada-LTS 2.7.8.1. This issue affects some unknown processing of the file view_edit.shtm of the component SVG Fil… |
CVE-2025-9144 | Low | 3.5 | 2025-08-19 | A weakness has been identified in Scada-LTS 2.7.8.1. This vulnerability affects unknown code of the file publisher_edit.shtm. This manipulation of the argument… |
CVE-2025-9143 | Low | 3.5 | 2025-08-19 | A security flaw has been discovered in Scada-LTS 2.7.8.1. This affects an unknown part of the file mailing_lists.shtm. The manipulation of the argument name/us… |
CVE-2025-50567 | Critical | 10.0 | 2025-08-19 | Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modif… |
CVE-2025-9138 | Low | 3.5 | 2025-08-19 | A vulnerability was found in Scada-LTS 2.7.8.1. Affected is an unknown function of the file pointHierarchy/new/. Performing manipulation of the argument Title… |
CVE-2025-9137 | Low | 3.5 | 2025-08-19 | A vulnerability has been found in Scada-LTS 2.7.8.1. This impacts an unknown function of the file scheduled_events.shtm. Such manipulation of the argument alia… |
CVE-2025-8723 | Critical | 9.8 | 2025-08-19 | The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within it… |
CVE-2025-9119 | Low | 2.4 | 2025-08-18 | A vulnerability was determined in Netis WF2419 1.2.29433. This vulnerability affects unknown code of the file /index.htm of the component Wireless Settings Pag… |
CVE-2025-9107 | Medium | 4.3 | 2025-08-18 | A vulnerability was determined in Portabilis i-Diario up to 1.5.0. This impacts an unknown function of the file /alunos/search_autocomplete. Executing manipula… |
CVE-2025-9106 | Low | 3.5 | 2025-08-18 | A vulnerability was found in Portabilis i-Diario up to 1.5.0. This affects an unknown function of the file /planos-de-ensino-por-disciplina/ of the component I… |
CVE-2025-9105 | Low | 3.5 | 2025-08-18 | A vulnerability has been found in Portabilis i-Diario up to 1.5.0. The impacted element is an unknown function of the file /planos-de-ensino-por-areas-de-conhe… |
CVE-2025-9104 | Low | 3.5 | 2025-08-18 | A flaw has been found in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /planos-de-aulas-por-disciplina/ of the compo… |
CVE-2025-9103 | Low | 2.4 | 2025-08-18 | A vulnerability was detected in ZenCart 2.1.0. Affected by this vulnerability is an unknown functionality of the component CKEditor. The manipulation leads to… |
CVE-2025-9101 | Low | 3.5 | 2025-08-18 | A weakness has been identified in zhenfeng13 My-Blog up to 1.0.0. This issue affects some unknown processing of the file /admin/tags/save of the component Tag… |
CVE-2025-9096 | Low | 3.5 | 2025-08-18 | A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the c… |
CVE-2025-9095 | Low | 3.5 | 2025-08-17 | A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of th… |
CVE-2025-8878 | Medium | 6.5 | 2025-08-16 | The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerabl… |
CVE-2025-8105 | High | 7.3 | 2025-08-16 | The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due to the software all… |
CVE-2025-7961 | | 2025-08-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0. | |
CVE-2025-54466 | Critical | 9.8 | 2025-08-15 | Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. This issue affects Apache OFBi… |
CVE-2025-8905 | Medium | 6.3 | 2025-08-15 | The Inpersttion For Theme plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the theme_section_shortcode… |
CVE-2025-9017 | Medium | 4.3 | 2025-08-15 | A vulnerability has been found in PHPGurukul Zoo Management System 2.1. This vulnerability affects unknown code of the file /admin/add-foreigner-ticket.php. Th… |
CVE-2025-9003 | Low | 3.5 | 2025-08-15 | A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component DHCP Reserved Addres… |
CVE-2025-8976 | Low | 3.5 | 2025-08-14 | A vulnerability has been found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/index.php?module=content/post&type=p… |
CVE-2025-8975 | Low | 3.5 | 2025-08-14 | A vulnerability was identified in givanz Vvveb up to 1.0.5. This affects an unknown part of the file admin/template/content/edit.tpl. The manipulation of the a… |
CVE-2025-55192 | | 2025-08-14 | HomeAssistant-Tapo-Control offers Control for Tapo cameras as a Home Assistant component. Prior to commit 2a3b80f, there is a code injection vulnerability in t… | |
CVE-2025-49887 | Critical | 9.9 | 2025-08-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce… |
CVE-2025-39483 | Medium | 6.5 | 2025-08-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in imithemes Eventer eventer allows Code Injection.This issue affects Eventer: from n/a… |
CVE-2025-55346 | Critical | 9.8 | 2025-08-14 | User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in t… |
CVE-2025-8934 | Medium | 4.3 | 2025-08-14 | A vulnerability has been found in 1000 Projects Sales Management System 1.0. Affected is an unknown function of the file /sales.php. The manipulation of the ar… |
CVE-2025-8933 | Medium | 4.3 | 2025-08-14 | A vulnerability was identified in 1000 Projects Sales Management System 1.0. This issue affects some unknown processing of the file /superstore/admin/sales.php… |
CVE-2011-10019 | Critical | 9.8 | 2025-08-13 | Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitiz… |
CVE-2011-10018 | Critical | 9.8 | 2025-08-13 | myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP co… |
CVE-2011-10013 | | 2025-08-13 | Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt exec… | |
CVE-2011-10011 | | 2025-08-13 | WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is writte… | |
CVE-2025-8920 | Low | 2.4 | 2025-08-13 | A vulnerability was identified in Portabilis i-Diario 1.6. Affected by this vulnerability is an unknown functionality of the file /dicionario-de-termos-bncc of… |
CVE-2025-8919 | Low | 2.4 | 2025-08-13 | A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the co… |
CVE-2025-23306 | High | 7.8 | 2025-08-13 | NVIDIA Megatron-LM for all platforms contains a vulnerability in the megatron/training/ arguments.py component where an attacker could cause a code injection i… |
CVE-2025-23305 | High | 7.8 | 2025-08-13 | NVIDIA Megatron-LM for all platforms contains a vulnerability in the tools component, where an attacker may exploit a code injection issue. A successful exploi… |
CVE-2025-23304 | High | 7.8 | 2025-08-13 | NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection by loading .nemo fi… |
CVE-2025-23298 | High | 7.8 | 2025-08-13 | NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability in a python dependency, where an attacker could cause a code injection issue. A succe… |