CWE-94 · Code Injection (page 23)
Page 23 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-2079 | Critical | 9.9 | 2025-04-28 | Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form o… |
CVE-2025-4022 | Medium | 6.3 | 2025-04-28 | A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator o… |
CVE-2025-46661 | Critical | 10.0 | 2025-04-28 | IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions… |
CVE-2025-4011 | Low | 3.5 | 2025-04-28 | A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custo… |
CVE-2025-4000 | Low | 3.5 | 2025-04-28 | A vulnerability, which was classified as problematic, was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. Affected is an unknown function of the fil… |
CVE-2025-3999 | Low | 3.5 | 2025-04-28 | A vulnerability, which was classified as problematic, has been found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. This issue affects some unknown proce… |
CVE-2025-3996 | Low | 2.4 | 2025-04-28 | A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as problematic. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-3995 | Low | 2.4 | 2025-04-28 | A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been declared as problematic. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-3994 | Low | 2.4 | 2025-04-28 | A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been classified as problematic. Affected is an unknown function of the file /home.htm of t… |
CVE-2025-3984 | Medium | 5.0 | 2025-04-27 | A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\… |
CVE-2025-3982 | Medium | 4.3 | 2025-04-27 | A vulnerability, which was classified as problematic, was found in nortikin Sverchok 1.3.0. Affected is the function SvSetPropNodeMK2 of the file sverchok/node… |
CVE-2025-3970 | Low | 3.5 | 2025-04-27 | A vulnerability classified as problematic has been found in baseweb JSite up to 1.0. Affected is an unknown function of the file /sys/office/save. The manipula… |
CVE-2025-3965 | Low | 3.5 | 2025-04-27 | A vulnerability has been found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-3962 | Low | 3.5 | 2025-04-27 | A vulnerability classified as problematic was found in withstars Books-Management-System 1.0. This vulnerability affects unknown code of the file /api/comment/… |
CVE-2025-3961 | Low | 3.5 | 2025-04-27 | A vulnerability classified as problematic has been found in withstars Books-Management-System 1.0. This affects an unknown part of the file /admin/article/add/… |
CVE-2025-3958 | Low | 3.5 | 2025-04-27 | A vulnerability was found in withstars Books-Management-System 1.0. It has been classified as problematic. Affected is an unknown function of the file /book_ed… |
CVE-2025-46579 | High | 8.4 | 2025-04-27 | There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and when users download an… |
CVE-2024-13812 | Medium | 6.5 | 2025-04-26 | The The Anps Theme plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.1. This is due to the s… |
CVE-2025-3491 | High | 7.2 | 2025-04-26 | The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2… |
CVE-2024-13808 | High | 8.8 | 2025-04-26 | The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widg… |
CVE-2025-2801 | High | 7.3 | 2025-04-26 | The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in… |
CVE-2025-3642 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers a… |
CVE-2025-3641 | High | 8.8 | 2025-04-25 | A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers a… |
CVE-2025-32432 | Critical | 10.0 | 2025-04-25 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-R… |
CVE-2025-3776 | High | 8.3 | 2025-04-24 | The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targ… |
CVE-2025-1976 | Medium | 6.7 | 2025-04-24 | Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with… |
CVE-2025-0618 | Medium | 6.5 | 2025-04-23 | A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper protection event t… |
CVE-2023-43958 | Critical | 9.8 | 2025-04-22 | An arbitrary file upload vulnerability in the component /jquery-file-upload/server/php/index.php of Hospital Management System v4.0 allows an unauthenticated a… |
CVE-2025-23251 | High | 7.6 | 2025-04-22 | NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution. A successful exploi… |
CVE-2024-40446 | Critical | 9.8 | 2025-04-22 | An issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted script |
CVE-2025-3472 | Medium | 6.5 | 2025-04-22 | The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software al… |
CVE-2025-3842 | Medium | 6.3 | 2025-04-21 | A vulnerability was found in panhainan DS-Java 1.0 and classified as critical. This issue affects the function uploadUserPic.action of the file src/com/phn/act… |
CVE-2025-3841 | Low | 3.3 | 2025-04-21 | A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown pa… |
CVE-2025-3826 | Low | 2.4 | 2025-04-20 | A vulnerability, which was classified as problematic, was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown par… |
CVE-2025-3825 | Low | 2.4 | 2025-04-20 | A vulnerability, which was classified as problematic, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this issue… |
CVE-2025-3824 | Low | 2.4 | 2025-04-20 | A vulnerability classified as problematic was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an un… |
CVE-2025-3823 | Low | 2.4 | 2025-04-20 | A vulnerability classified as problematic has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of… |
CVE-2025-3822 | Low | 2.4 | 2025-04-20 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been rated as problematic. This issue affects some unknown… |
CVE-2025-3821 | Low | 2.4 | 2025-04-20 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as problematic. This vulnerability affects u… |
CVE-2025-3806 | Low | 2.4 | 2025-04-19 | A vulnerability, which was classified as problematic, has been found in dazhouda lecms up to 3.0.3. Affected by this issue is some unknown functionality of the… |
CVE-2025-3801 | Low | 2.4 | 2025-04-19 | A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Set… |
CVE-2025-29058 | Critical | 9.8 | 2025-04-18 | An issue in Qimou CMS v.3.34.0 allows a remote attacker to execute arbitrary code via the upgrade.php component. |
CVE-2025-3795 | Low | 2.4 | 2025-04-18 | A vulnerability was found in DaiCuo 1.3.13. It has been rated as problematic. Affected by this issue is some unknown functionality of the component SEO Optimiz… |
CVE-2025-3789 | Low | 3.5 | 2025-04-18 | A vulnerability was found in baseweb JSite 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /a/sys/area/… |
CVE-2025-3788 | Low | 3.5 | 2025-04-18 | A vulnerability was found in baseweb JSite 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /a/… |
CVE-2025-3509 | High | 7.2 | 2025-04-17 | A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-r… |
CVE-2024-53924 | Critical | 9.8 | 2025-04-17 | Pycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginning with the =IF(A1=… |
CVE-2025-29662 | Critical | 9.8 | 2025-04-17 | A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access. |
CVE-2025-29661 | High | 7.2 | 2025-04-17 | Litepubl CMS <= 7.0.9 is vulnerable to RCE in admin/service/run. |
CVE-2025-29039 | High | 7.2 | 2025-04-17 | An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8 |
CVE-2025-32596 | High | 7.3 | 2025-04-17 | Improper Control of Generation of Code ('Code Injection') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Code Injection.This issu… |
CVE-2025-32583 | Critical | 9.9 | 2025-04-17 | Improper Control of Generation of Code ('Code Injection') vulnerability in termel PDF 2 Post pdf2post allows Remote Code Inclusion.This issue affects PDF 2 Pos… |
CVE-2024-56518 | Critical | 9.8 | 2025-04-17 | Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML document (aka a client c… |
CVE-2025-1532 | High | 8.1 | 2025-04-17 | Phoneservice module is affected by code injection vulnerability, successful exploitation of this vulnerability may affect service confidentiality and integrity. |
CVE-2024-53303 | High | 8.8 | 2025-04-16 | A remote code execution (RCE) vulnerability in the upload_file function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated attackers to execute… |
CVE-2025-3692 | Low | 2.4 | 2025-04-16 | A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown function… |
CVE-2025-3688 | Low | 2.4 | 2025-04-16 | A vulnerability, which was classified as problematic, was found in mirweiye Seven Bears Library CMS 2023. This affects an unknown part of the component Backgro… |
CVE-2025-26996 | Medium | 6.5 | 2025-04-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Code Injection.This issue affects… |
CVE-2024-50960 | High | 7.2 | 2025-04-15 | A command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 <=3.01, SMP 351 <=2.16, SMP 352 <= 2.16, and SME 211 <… |
CVE-2025-29281 | High | 8.8 | 2025-04-15 | In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute… |
CVE-2025-3579 | | 2025-04-15 | In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute unauthorised commands within the system. T… | |
CVE-2025-3613 | Low | 3.5 | 2025-04-15 | A vulnerability has been found in Demtec Graphytics 5.0.7 and classified as problematic. This vulnerability affects unknown code of the file /visualization. Th… |
CVE-2025-3612 | Medium | 4.3 | 2025-04-15 | A vulnerability, which was classified as problematic, was found in Demtec Graphytics 5.0.7. This affects an unknown part of the file /visualization of the comp… |
CVE-2025-3592 | Low | 3.5 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been classified as problematic. This affects an unknown part of the file /admin… |
CVE-2025-3591 | Low | 3.5 | 2025-04-14 | A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0 and classified as problematic. Affected by this issue is some unknown functionality of… |
CVE-2025-1782 | Critical | 9.9 | 2025-04-14 | In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used and can be misused to include an arbit… |
CVE-2025-3570 | Low | 3.5 | 2025-04-14 | A vulnerability was found in JamesZBL/code-projects db-hospital-drug 1.0. It has been classified as problematic. This affects the function Save of the file Con… |
CVE-2025-3568 | Low | 3.5 | 2025-04-14 | A vulnerability has been found in Webkul Krayin CRM up to 2.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-3563 | Medium | 4.7 | 2025-04-14 | A vulnerability was found in WuzhiCMS 4.1. It has been rated as critical. Affected by this issue is the function Set of the file /index.php?m=attachment&f=inde… |
CVE-2025-3560 | Low | 3.5 | 2025-04-14 | A vulnerability was found in ghostxbh uzy-ssm-mall 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /product. The ma… |
CVE-2025-3554 | Medium | 4.3 | 2025-04-14 | A vulnerability was found in phpshe 1.8. It has been rated as problematic. This issue affects some unknown processing of the file api.php?mod=cron&act=buyer. T… |
CVE-2025-3533 | Medium | 4.3 | 2025-04-13 | A vulnerability, which was classified as problematic, has been found in YouDianCMS 9.5.21. This issue affects some unknown processing of the file /App/Tpl/Admi… |
CVE-2025-3532 | Medium | 4.3 | 2025-04-13 | A vulnerability classified as problematic was found in YouDianCMS 9.5.21. This vulnerability affects unknown code of the file /App/Tpl/Member/Default/Order/ind… |
CVE-2025-3531 | Medium | 4.3 | 2025-04-13 | A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html… |
CVE-2023-42875 | High | 7.3 | 2025-04-11 | Processing web content may lead to arbitrary code execution. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14, watchOS 10, tvOS 17, Safari 17. The… |
CVE-2025-3422 | Medium | 5.4 | 2025-04-11 | The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode e… |
CVE-2024-13861 | High | 7.8 | 2025-04-11 | A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code ex… |
CVE-2025-32383 | Medium | 4.3 | 2025-04-10 | MaxKB (Max Knowledge Base) is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG)… |
CVE-2025-2809 | High | 7.3 | 2025-04-10 | The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is… |
CVE-2025-2805 | High | 7.3 | 2025-04-10 | The ORDER POST plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software all… |
CVE-2025-3489 | Medium | 4.3 | 2025-04-10 | A vulnerability was found in Nababur Simple-User-Management-System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality… |
CVE-2025-3115 | Critical | 9.8 | 2025-04-09 | Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficie… |
CVE-2025-3114 | | 2025-04-09 | Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, pote… | |
CVE-2025-31330 | Critical | 9.9 | 2025-04-08 | SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables… |
CVE-2025-30013 | Medium | 6.7 | 2025-04-08 | SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privile… |
CVE-2025-27429 | Critical | 9.9 | 2025-04-08 | SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbit… |
CVE-2025-23186 | High | 8.5 | 2025-04-08 | In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted desti… |
CVE-2025-3397 | Medium | 4.3 | 2025-04-08 | A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argume… |
CVE-2025-3393 | Low | 3.5 | 2025-04-08 | A vulnerability was found in mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef35301545143509. It has been classified as problematic. This affects an… |
CVE-2025-3392 | Low | 3.5 | 2025-04-08 | A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this issue is the function Save of the file cn/gso… |
CVE-2025-3391 | Low | 3.5 | 2025-04-08 | A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this vulnerability is the function outAddress… |
CVE-2025-3390 | Low | 3.5 | 2025-04-08 | A vulnerability, which was classified as problematic, was found in hailey888 oa_system up to 2025.01.01. Affected is the function addandchangeday of the file c… |
CVE-2025-3389 | Low | 3.5 | 2025-04-08 | A vulnerability, which was classified as problematic, has been found in hailey888 oa_system up to 2025.01.01. This issue affects the function testMess of the f… |
CVE-2025-3388 | Medium | 4.3 | 2025-04-07 | A vulnerability classified as problematic was found in hailey888 oa_system up to 2025.01.01. This vulnerability affects the function loginCheck of the file cn/… |
CVE-2025-3387 | Low | 3.5 | 2025-04-07 | A vulnerability classified as problematic has been found in renrenio renren-security up to 5.4.0. This affects an unknown part of the component JSON Handler. T… |
CVE-2025-3386 | Low | 2.4 | 2025-04-07 | A vulnerability was found in LinZhaoguan pb-cms 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin#… |
CVE-2025-3385 | Low | 2.4 | 2025-04-07 | A vulnerability was found in LinZhaoguan pb-cms 2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the com… |
CVE-2025-3248 | Critical | 9.8 | 2025-04-07 | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send craft… |
CVE-2025-3327 | Low | 3.5 | 2025-04-07 | A vulnerability was found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This issue affects some unknown processing of the file /common/upload/batch… |
CVE-2025-3326 | Low | 3.5 | 2025-04-07 | A vulnerability has been found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This vulnerability affects unknown code of the file /common/upload of… |