CWE-94 · Code Injection (page 22)
Page 22 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5383 | Low | 2.4 | 2025-05-31 | A vulnerability was found in Yifang CMS up to 2.0.2 and classified as problematic. Affected by this issue is some unknown functionality of the component Articl… |
CVE-2025-5378 | Medium | 4.3 | 2025-05-31 | A vulnerability classified as problematic has been found in Astun Technology iShare Maps 5.4.0. This affects an unknown part of the file mycouncil2.aspx. The m… |
CVE-2025-5377 | Medium | 4.3 | 2025-05-31 | A vulnerability was found in Astun Technology iShare Maps 5.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2025-48390 | High | 7.2 | 2025-05-29 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code injection due to insufficient validatio… |
CVE-2025-32801 | High | 7.8 | 2025-05-28 | Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unse… |
CVE-2025-5181 | Low | 3.5 | 2025-05-26 | A vulnerability, which was classified as problematic, was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1. This affects an unknown… |
CVE-2025-5179 | Low | 2.4 | 2025-05-26 | A vulnerability classified as problematic was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. Affected by this vulnerability is an unknown functi… |
CVE-2025-5177 | Medium | 4.3 | 2025-05-26 | A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2025-5153 | Low | 3.5 | 2025-05-25 | A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Des… |
CVE-2025-5151 | Medium | 5.3 | 2025-05-25 | A vulnerability classified as critical has been found in defog-ai introspect up to 0.1.4. This affects the function execute_analysis_code_safely of the file in… |
CVE-2025-5150 | Medium | 6.3 | 2025-05-25 | A vulnerability was found in docarray up to 0.40.1. It has been rated as critical. Affected by this issue is the function __getitem__ of the file /docarray/dat… |
CVE-2025-5138 | Low | 3.5 | 2025-05-25 | A vulnerability was found in Bitwarden up to 2.25.1. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the com… |
CVE-2025-5137 | Medium | 4.7 | 2025-05-25 | A vulnerability was found in DedeCMS 5.7.117. It has been classified as critical. Affected is an unknown function of the file dede/sys_verifies.php?action=getf… |
CVE-2025-5135 | Low | 2.4 | 2025-05-24 | A vulnerability, which was classified as problematic, has been found in Tmall Demo up to 20250505. Affected by this issue is some unknown functionality of the… |
CVE-2025-5134 | Low | 3.5 | 2025-05-24 | A vulnerability classified as problematic was found in Tmall Demo up to 20250505. Affected by this vulnerability is an unknown functionality of the component B… |
CVE-2025-5133 | Medium | 4.3 | 2025-05-24 | A vulnerability classified as problematic has been found in Tmall Demo up to 20250505. Affected is an unknown function of the component Search Box. The manipul… |
CVE-2025-5127 | Low | 3.5 | 2025-05-24 | A vulnerability was determined in Teledyne FLIR AX8 up to 1.46.16. This issue affects some unknown processing of the file /prod.php. Executing manipulation of… |
CVE-2024-51360 | Critical | 9.8 | 2025-05-23 | An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file |
CVE-2024-13952 | High | 8.4 | 2025-05-22 | Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis iss… |
CVE-2025-30172 | High | 8.0 | 2025-05-22 | Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: throu… |
CVE-2024-9639 | High | 8.0 | 2025-05-22 | Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised. This issue affects ASPECT-Enterprise: thr… |
CVE-2024-13929 | High | 7.2 | 2025-05-22 | Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Ente… |
CVE-2024-13928 | High | 7.2 | 2025-05-22 | SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromis… |
CVE-2025-45753 | High | 7.2 | 2025-05-21 | A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import fu… |
CVE-2025-45752 | High | 7.2 | 2025-05-21 | A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functionality in the Exte… |
CVE-2025-27998 | High | 8.4 | 2025-05-21 | An issue in Valvesoftware Steam Client Steam Client 1738026274 allows attackers to escalate privileges via a crafted executable or DLL. |
CVE-2025-5013 | Medium | 4.3 | 2025-05-21 | A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.h… |
CVE-2025-5011 | Low | 2.4 | 2025-05-21 | A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html o… |
CVE-2025-5010 | Low | 2.4 | 2025-05-21 | A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the… |
CVE-2025-5007 | Low | 3.5 | 2025-05-20 | A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file… |
CVE-2025-44881 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted inp… |
CVE-2025-4996 | Low | 2.4 | 2025-05-20 | A vulnerability, which was classified as problematic, has been found in Intelbras RF 301K 1.1.5. This issue affects some unknown processing of the component Ad… |
CVE-2025-46725 | Critical | 9.8 | 2025-05-20 | Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `LanceDocChatAgent` uses pandas eval() throu… |
CVE-2025-46724 | Critical | 9.8 | 2025-05-20 | Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fe… |
CVE-2025-4939 | Medium | 4.3 | 2025-05-19 | A vulnerability classified as problematic was found in PHPGurukul Credit Card Application Management System 1.0. This vulnerability affects unknown code of the… |
CVE-2025-26621 | High | 7.6 | 2025-05-19 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manag… |
CVE-2025-4866 | Medium | 6.3 | 2025-05-18 | A vulnerability was found in weibocom rill-flow 0.1.18. It has been classified as critical. Affected is an unknown function of the component Management Console… |
CVE-2025-4862 | Medium | 4.3 | 2025-05-18 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Directory Management System 2.0. Affected by this issue is some unknown func… |
CVE-2025-4860 | Low | 2.4 | 2025-05-18 | A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137_ALL_en_20210528. Affected is an unknown function of the file /adv_dhcps… |
CVE-2025-4859 | Low | 2.4 | 2025-05-18 | A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been rated as problematic. This issue affects some unknown processing of the fi… |
CVE-2025-4858 | Low | 2.4 | 2025-05-18 | A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been declared as problematic. This vulnerability affects unknown code of the fi… |
CVE-2025-4852 | Low | 2.4 | 2025-05-18 | A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the… |
CVE-2025-48120 | Medium | 5.3 | 2025-05-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issu… |
CVE-2025-48119 | Medium | 5.3 | 2025-05-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in RS WP THEMES RS WP Book Showcase rs-wp-books-showcase allows Code Injection.This iss… |
CVE-2025-47562 | Medium | 5.3 | 2025-05-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg allows Code Injection.This issue affects MapSVG: from n/a th… |
CVE-2025-47916 | Critical | 10.0 | 2025-05-16 | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor contr… |
CVE-2025-4767 | Medium | 5.3 | 2025-05-16 | A vulnerability was found in defog-ai introspect up to 0.1.4. It has been rated as critical. Affected by this issue is the function test_custom_tool of the fil… |
CVE-2025-4745 | Low | 3.5 | 2025-05-16 | A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. This affects an unknown part of the file current_e… |
CVE-2025-4744 | Low | 3.5 | 2025-05-16 | A vulnerability, which was classified as problematic, has been found in code-projects Employee Record System 1.0. Affected by this issue is some unknown functi… |
CVE-2025-3053 | High | 8.8 | 2025-05-15 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and… |
CVE-2025-32363 | Critical | 9.8 | 2025-05-14 | mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data. |
CVE-2025-0134 | | 2025-05-14 | A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on t… | |
CVE-2024-54780 | High | 8.8 | 2025-05-14 | Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper saniti… |
CVE-2024-24780 | Critical | 9.8 | 2025-05-14 | Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function fro… |
CVE-2025-4428 | High | 7.2 | 2025-05-13 | Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute… |
CVE-2025-45857 | Critical | 9.8 | 2025-05-13 | EDIMAX CV7428NS v1.20 was discovered to contain a remote code execution (RCE) vulnerability via the command parameter in the mp function. |
CVE-2025-43010 | High | 8.3 | 2025-05-13 | SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a cer… |
CVE-2025-44022 | Critical | 9.8 | 2025-05-12 | An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. |
CVE-2025-47271 | | 2025-05-12 | The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13… | |
CVE-2025-4551 | Low | 3.5 | 2025-05-11 | A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Affected is an unknown function of the file /dev-api/common/file… |
CVE-2025-4547 | Low | 2.4 | 2025-05-11 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been rated as problematic. Affected by this issue is some… |
CVE-2025-4531 | Medium | 6.3 | 2025-05-11 | A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been rated as critical. Affected by this issue is the function postData o… |
CVE-2025-4512 | Medium | 4.3 | 2025-05-10 | A vulnerability classified as problematic has been found in Inetum IODAS 7.2-LTS.4.1-JDK7/7.2-RC3.2-JDK7. Affected is an unknown function of the file /astre/io… |
CVE-2025-4495 | Low | 3.5 | 2025-05-10 | A vulnerability has been found in JAdmin-JAVA JAdmin 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-46191 | Critical | 9.8 | 2025-05-09 | Arbitrary File Upload in user_payment_update.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files… |
CVE-2025-28203 | High | 8.8 | 2025-05-09 | Victure RX1800 EN_V1.0.0_r12_110933 was discovered to contain a command injection vulnerability. |
CVE-2025-1087 | | 2025-05-09 | Kong Insomnia Desktop Application before 11.0.2 contains a template injection vulnerability that allows attackers to execute arbitrary code. The vulnerability… | |
CVE-2025-4470 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic was found in SourceCodester Online Student Clearance System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2025-4469 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic has been found in SourceCodester Online Student Clearance System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-4461 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic was found in TOTOLINK N150RT 3.4.0-B20190525. This vulnerability affects unknown code of the component Virtual Server… |
CVE-2025-4460 | Low | 2.4 | 2025-05-09 | A vulnerability classified as problematic has been found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the component URL Filtering Page… |
CVE-2025-26845 | Critical | 9.8 | 2025-05-08 | An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a command executed by… |
CVE-2025-4208 | Medium | 6.3 | 2025-05-08 | The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and inc… |
CVE-2024-13793 | High | 7.3 | 2025-05-08 | The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includin… |
CVE-2023-7303 | Low | 3.5 | 2025-05-07 | A vulnerability, which was classified as problematic, was found in q2apro q2apro-on-site-notifications up to 1.4.6. This affects the function process_request o… |
CVE-2025-47691 | Medium | 5.5 | 2025-05-07 | Improper Control of Generation of Code ('Code Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Code Injection.This issue aff… |
CVE-2025-47481 | Medium | 5.3 | 2025-05-07 | Improper Control of Generation of Code ('Code Injection') vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Code Injection.This issue aff… |
CVE-2025-4326 | Low | 2.4 | 2025-05-06 | A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects some unknown processing of the file /admin/chip/add.do of the compon… |
CVE-2025-4325 | Low | 2.4 | 2025-05-06 | A vulnerability has been found in MRCMS 3.1.2 and classified as problematic. This vulnerability affects unknown code of the file /admin/category/add.do of the… |
CVE-2025-4324 | Low | 2.4 | 2025-05-06 | A vulnerability, which was classified as problematic, was found in MRCMS 3.1.2. This affects an unknown part of the file /admin/link/edit.do of the component E… |
CVE-2025-4323 | Low | 2.4 | 2025-05-06 | A vulnerability, which was classified as problematic, has been found in MRCMS 3.1.2. Affected by this issue is some unknown functionality of the component Edit… |
CVE-2025-2802 | High | 7.3 | 2025-05-06 | The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software all… |
CVE-2025-4293 | Low | 2.4 | 2025-05-05 | A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/group/edit.do o… |
CVE-2025-4292 | Low | 2.4 | 2025-05-05 | A vulnerability has been found in MRCMS 3.1.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/user… |
CVE-2025-44071 | Critical | 9.8 | 2025-05-05 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execu… |
CVE-2025-43845 | Critical | 9.8 | 2025-05-05 | Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to code injection. The ckpt_pa… |
CVE-2025-24977 | Critical | 9.1 | 2025-05-05 | OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands… |
CVE-2025-4261 | Medium | 5.3 | 2025-05-05 | A vulnerability was found in GAIR-NLP factool up to 3f3914bc090b644be044b7e0005113c135d8b20f. It has been classified as critical. This affects the function run… |
CVE-2025-4257 | Low | 3.5 | 2025-05-05 | A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2. This issue affects some unknown processing of the file /admin_pay.php. The… |
CVE-2025-4256 | Low | 3.5 | 2025-05-05 | A vulnerability classified as problematic was found in SeaCMS 13.2. This vulnerability affects unknown code of the file /admin_paylog.php. The manipulation of… |
CVE-2024-13738 | High | 7.3 | 2025-05-03 | The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2025-4218 | Medium | 5.3 | 2025-05-02 | A vulnerability was found in handrew browserpilot up to 0.2.51. It has been declared as critical. Affected by this vulnerability is the function GPTSeleniumAge… |
CVE-2025-2421 | Critical | 9.8 | 2025-05-02 | Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Informatics SambaBox allows Code Injection. This issue affects SambaBox: b… |
CVE-2024-13420 | Medium | 4.3 | 2025-05-02 | Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_se… |
CVE-2025-46569 | | 2025-05-01 | Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for readin… | |
CVE-2025-4075 | Medium | 4.3 | 2025-04-29 | A vulnerability was found in VMSMan up to 20250416. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /login.p… |
CVE-2025-45947 | Critical | 9.8 | 2025-04-28 | An issue in phpgurukul Online Banquet Booking System V1.2 allows an attacker to execute arbitrary code via the /obbs/change-password.php file of the My Account… |
CVE-2024-32499 | Medium | 4.9 | 2025-04-28 | Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is exposed. |
CVE-2023-42404 | Medium | 4.9 | 2025-04-28 | OneVision Workspace before WS23.1 SR1 (build w31.040) allows arbitrary Java EL execution. |
CVE-2025-23376 | Low | 2.3 | 2025-04-28 | Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine v… |