CWE-94 · Code Injection (page 24)
Page 24 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3326 | Low | 3.5 | 2025-04-07 | A vulnerability has been found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This vulnerability affects unknown code of the file /common/upload of… |
CVE-2025-3297 | Low | 3.5 | 2025-04-05 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes… |
CVE-2025-3253 | Low | 3.5 | 2025-04-04 | A vulnerability was found in xujiangfei admintwo 1.0 and classified as problematic. This issue affects some unknown processing of the file /ztree/insertTree. T… |
CVE-2025-3252 | Low | 3.5 | 2025-04-04 | A vulnerability has been found in xujiangfei admintwo 1.0 and classified as problematic. This vulnerability affects unknown code of the file /resource/add. The… |
CVE-2025-3251 | Low | 3.5 | 2025-04-04 | A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manip… |
CVE-2025-28146 | Critical | 9.8 | 2025-04-04 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefo… |
CVE-2025-3219 | Low | 3.5 | 2025-04-04 | A vulnerability was found in CodeCanyon Perfex CRM 3.2.1. It has been classified as problematic. Affected is an unknown function of the file /perfex/clients/pr… |
CVE-2024-13645 | Critical | 9.8 | 2025-04-04 | The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes i… |
CVE-2024-45199 | High | 8.8 | 2025-04-03 | insightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JND… |
CVE-2025-29064 | Critical | 9.8 | 2025-04-03 | An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi. |
CVE-2025-26818 | Critical | 9.8 | 2025-04-03 | Netwrix Password Secure through 9.2 allows command injection. |
CVE-2024-45198 | High | 8.8 | 2025-04-03 | insightsoftware Spark JDBC 2.6.21 has a remote code execution vulnerability. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injec… |
CVE-2025-3164 | Medium | 4.7 | 2025-04-03 | A vulnerability was found in Tencent Music Entertainment SuperSonic up to 0.9.8. It has been rated as critical. Affected by this issue is some unknown function… |
CVE-2025-3163 | Medium | 5.3 | 2025-04-03 | A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file l… |
CVE-2025-3157 | Low | 2.4 | 2025-04-03 | A vulnerability was found in Intelbras WRN 150 1.0.15_pt_ITB01. It has been rated as problematic. This issue affects some unknown processing of the component W… |
CVE-2025-2945 | Critical | 9.9 | 2025-04-03 | Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoint… |
CVE-2025-3152 | Low | 3.5 | 2025-04-03 | A vulnerability classified as problematic has been found in caipeichao ThinkOX 1.0. This affects an unknown part of the file /ThinkOX-master/index.php?s=/Weibo… |
CVE-2025-3149 | Low | 2.4 | 2025-04-03 | A vulnerability was found in itning Student Homework Management System up to 1.2.7. It has been classified as problematic. Affected is an unknown function of t… |
CVE-2025-31722 | High | 8.8 | 2025-04-02 | In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configu… |
CVE-2025-30580 | Critical | 10.0 | 2025-04-01 | Improper Control of Generation of Code ('Code Injection') vulnerability in kellydiek DigiWidgets Image Editor digiwidgets-image-editor allows Remote Code Inclu… |
CVE-2025-30911 | Critical | 9.9 | 2025-04-01 | Improper Control of Generation of Code ('Code Injection') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Command Injection.This issue affects… |
CVE-2025-24243 | High | 7.8 | 2025-03-31 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5… |
CVE-2025-3036 | Low | 2.4 | 2025-03-31 | A vulnerability, which was classified as problematic, was found in yzk2356911358 StudentServlet-JSP cc0cdce25fbe43b6c58b60a77a2c85f52d2102f5/d4d7a0643f1dae908a… |
CVE-2024-54807 | Critical | 9.8 | 2025-03-31 | In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient pa… |
CVE-2024-54806 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web int… |
CVE-2024-54805 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram para… |
CVE-2024-54804 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram para… |
CVE-2024-54803 | Critical | 9.8 | 2025-03-31 | Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram para… |
CVE-2025-3005 | Low | 3.5 | 2025-03-31 | A vulnerability was found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this issue is some unknown functionality of the compon… |
CVE-2025-3004 | Low | 3.5 | 2025-03-31 | A vulnerability has been found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-2981 | Low | 3.5 | 2025-03-31 | A vulnerability, which was classified as problematic, has been found in Legrand SMS PowerView 1.x. This issue affects some unknown processing. The manipulation… |
CVE-2025-2979 | Low | 2.4 | 2025-03-31 | A vulnerability classified as problematic has been found in WCMS 11. This affects an unknown part of the file /index.php?anonymous/setregister of the component… |
CVE-2025-2977 | Low | 3.5 | 2025-03-31 | A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-2976 | Low | 3.5 | 2025-03-31 | A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the component File Upload. The… |
CVE-2025-2975 | Low | 3.5 | 2025-03-31 | A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic. This issue affects some unknown processing of the file Settings/Email/Signa… |
CVE-2025-2974 | Low | 3.5 | 2025-03-31 | A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contrac… |
CVE-2025-2803 | High | 7.3 | 2025-03-29 | The So-Called Air Quotes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.1. This is due to the soft… |
CVE-2024-13557 | Medium | 6.5 | 2025-03-29 | The Shortcodes by United Themes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.1.6. This is due to… |
CVE-2025-2878 | Low | 2.4 | 2025-03-27 | A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-29306 | Critical | 9.8 | 2025-03-27 | An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. |
CVE-2025-30067 | High | 7.2 | 2025-03-27 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permiss… |
CVE-2025-2867 | Medium | 4.4 | 2025-03-27 | An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A sp… |
CVE-2025-2787 | High | 8.8 | 2025-03-26 | KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 ( a.k.a IngressNightmare ) vulnerability which affects the ingress-nginx component. In the wo… |
CVE-2024-55964 | Critical | 9.8 | 2025-03-26 | An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside t… |
CVE-2025-26003 | Critical | 9.8 | 2025-03-26 | Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest. |
CVE-2024-41643 | Medium | 6.8 | 2025-03-26 | An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component. |
CVE-2025-28893 | Critical | 9.9 | 2025-03-26 | Improper Control of Generation of Code ('Code Injection') vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue… |
CVE-2024-55028 | Critical | 9.8 | 2025-03-25 | A template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a crafted Vue file. |
CVE-2024-48818 | Critical | 9.8 | 2025-03-25 | An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code. |
CVE-2024-45480 | | 2025-03-25 | An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticat… | |
CVE-2025-2715 | Low | 3.5 | 2025-03-24 | A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatch_Inv… |
CVE-2025-2714 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2025-2712 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-2711 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been classified as problematic. Affected is an unknown function of the file /help/systop.jsp. The… |
CVE-2025-2710 | Medium | 4.3 | 2025-03-24 | A vulnerability was found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This issue affects some unknown processing of the file /menu.jsp. The manip… |
CVE-2025-2709 | Medium | 4.3 | 2025-03-24 | A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 and classified as problematic. This vulnerability affects unknown code of the file /login.jsp. The ma… |
CVE-2025-2700 | Low | 3.5 | 2025-03-24 | A vulnerability classified as problematic has been found in michelson Dante Editor up to 0.4.4. This affects an unknown part of the component Insert Link Handl… |
CVE-2025-2699 | Low | 3.5 | 2025-03-24 | A vulnerability was found in GetmeUK ContentTools up to 1.6.16. It has been rated as problematic. Affected by this issue is some unknown functionality of the c… |
CVE-2025-2673 | Low | 3.5 | 2025-03-24 | A vulnerability classified as problematic has been found in code-projects Payroll Management System 1.0. Affected is an unknown function of the file /home_empl… |
CVE-2025-29806 | Medium | 6.5 | 2025-03-23 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-2650 | Low | 3.5 | 2025-03-23 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Medical Card Generation System 1.0. This issue affects some unknown processi… |
CVE-2025-2645 | Low | 3.5 | 2025-03-23 | A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /… |
CVE-2025-2623 | Low | 3.5 | 2025-03-22 | A vulnerability was found in westboy CicadasCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-2617 | Low | 2.4 | 2025-03-22 | A vulnerability classified as problematic was found in yangyouwang 杨有旺 crud 简约后台管理系统 1.0.0. Affected by this vulnerability is an unknown functionality of the c… |
CVE-2025-2616 | Low | 2.4 | 2025-03-22 | A vulnerability classified as problematic has been found in yangyouwang 杨有旺 crud 简约后台管理系统 1.0.0. Affected is an unknown function of the component Role Manageme… |
CVE-2025-2303 | High | 8.8 | 2025-03-22 | The Block Logic – Full Gutenberg Block Display Control plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.8… |
CVE-2025-2590 | Low | 2.4 | 2025-03-21 | A vulnerability was found in code-projects Human Resource Management System 1.0.1. It has been classified as problematic. Affected is the function UpdateRecrui… |
CVE-2025-2583 | Low | 3.5 | 2025-03-21 | A vulnerability was found in SimpleMachines SMF 2.1.4. It has been classified as problematic. This affects an unknown part of the file ManageNews.php. The mani… |
CVE-2025-2582 | Low | 3.5 | 2025-03-21 | A vulnerability was found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the file ManageAtt… |
CVE-2025-29807 | High | 8.7 | 2025-03-21 | Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. |
CVE-2025-0185 | High | 8.8 | 2025-03-20 | A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability… |
CVE-2024-9439 | High | 8.8 | 2025-03-20 | SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which ar… |
CVE-2024-6982 | High | 8.4 | 2025-03-20 | A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's `eval(… |
CVE-2024-6825 | High | 8.8 | 2025-03-20 | BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'post_call_rules' configura… |
CVE-2024-12215 | High | 8.8 | 2025-03-20 | In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet. However, the functi… |
CVE-2024-10954 | High | 8.8 | 2025-03-20 | In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The ro… |
CVE-2024-10950 | High | 8.8 | 2025-03-20 | In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the ex… |
CVE-2024-10572 | High | 7.5 | 2025-03-20 | In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExt… |
CVE-2024-10252 | High | 7.2 | 2025-03-20 | A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enabl… |
CVE-2024-57061 | Critical | 9.8 | 2025-03-19 | An issue in Termius Version 9.9.0 through v.9.16.0 allows a physically proximate attacker to execute arbitrary code via the insecure Electron Fuses configurati… |
CVE-2025-29401 | Critical | 9.8 | 2025-03-19 | An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2025-2491 | Low | 2.4 | 2025-03-18 | A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com/ujcms/cms/ext/web/… |
CVE-2025-2490 | Low | 2.4 | 2025-03-18 | A vulnerability was found in Dromara ujcms 9.7.5. It has been rated as problematic. Affected by this issue is the function uploadZip/upload of the file /main/j… |
CVE-2024-21760 | High | 8.4 | 2025-03-18 | An improper control of generation of code ('Code Injection') vulnerability [CWE-94] in FortiSOAR Connector FortiSOAR 7.4 all versions, 7.3 all versions, 7.2 al… |
CVE-2025-2377 | Low | 3.5 | 2025-03-17 | A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality o… |
CVE-2025-2375 | Low | 3.5 | 2025-03-17 | A vulnerability, which was classified as problematic, was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected is an unknown funct… |
CVE-2025-2371 | Low | 3.5 | 2025-03-17 | A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been rated as problematic. Affected by this issue is some u… |
CVE-2025-2366 | Low | 2.4 | 2025-03-17 | A vulnerability, which was classified as problematic, was found in gougucms 4.08.18. This affects the function add of the file /admin/department/add of the com… |
CVE-2025-2364 | Low | 3.5 | 2025-03-17 | A vulnerability classified as problematic was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function addNewArticle of the file blogse… |
CVE-2025-2361 | Medium | 4.3 | 2025-03-17 | A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component W… |
CVE-2025-2354 | Medium | 4.3 | 2025-03-17 | A vulnerability has been found in VAM Virtual Airlines Manager 2.6.2 and classified as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2025-2352 | Low | 2.4 | 2025-03-16 | A vulnerability, which was classified as problematic, has been found in StarSea99 starsea-mall 1.0. This issue affects some unknown processing of the file /adm… |
CVE-2025-2340 | Low | 2.4 | 2025-03-16 | A vulnerability was found in otale Tale Blog 2.0.5. It has been declared as problematic. This vulnerability affects the function saveOptions of the file /optio… |
CVE-2025-2335 | Low | 3.5 | 2025-03-16 | A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/register… |
CVE-2025-26924 | Medium | 6.5 | 2025-03-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in colabrio Ohio Extra ohio-extra allows Code Injection.This issue affects Ohio Extra… |
CVE-2024-54448 | High | 7.2 | 2025-03-14 | The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with admin… |
CVE-2024-29409 | Medium | 5.5 | 2025-03-14 | File Upload vulnerability in nestjs nest v.10.3.2 allows a remote attacker to execute arbitrary code via the Content-Type header. |
CVE-2025-1119 | High | 7.3 | 2025-03-13 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versi… |
CVE-2025-27407 | Critical | 9.0 | 2025-03-12 | graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21… |
CVE-2025-26260 | High | 8.8 | 2025-03-12 | Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. Th… |